Changing the ID Token Expiration Period (2024)

FAQs

How do I change token expiration time? ›

Go to Dashboard > Applications > APIs and select the name of the API to view. Locate the Token Expiration field under Token Settings. Enter the desired lifetime (in seconds) for access tokens issued for this API.

ID tokens expire one hour after creation. You cannot change this expiration time. Under the hood, the client SDKs refresh the ID token using a long-lived token we call a refresh token. The refresh token is used to generate a new ID token every hour which allows the client SDKs to continue to work seamlessly.

This usually happens when a user session lasts longer than the token's lifespan. To resolve this issue, you can either refresh the token manually or set up an automatic token refresh in your application. Another solution is to increase the token's lifespan, but this could potentially compromise security.

To refresh your access token and an ID token, you send a token request with a grant_type of refresh_token . Be sure to include the openid scope when you want to refresh the ID token.

Go to the Settings tab. Under Refresh Token Expiration, enable Absolute Expiration. Enter Absolute Lifetime in seconds. Enable Inactivity Expiration.

Best practice

Set the expiration time for refresh tokens in such a way that it is valid for a little longer period than the access tokens. For example, if you set 30 minutes for access token then set (at least) 24 hours for the refresh token.

ID tokens are a type of security token that serves as proof of authentication, confirming that a user is successfully authenticated. Information in ID tokens enables the client to verify that a user is who they claim to be, similar to name tags at a conference.

In this article. When a token has expired or has been revoked, it can no longer be used to authenticate Git and API requests. It is not possible to restore an expired or revoked token, you or the application will need to create a new token.

Exchange a refresh token for an ID token. You can refresh an Identity Platform ID token by issuing an HTTP POST request to the securetoken.googleapis.com endpoint. Note: By default, Google validates the project number of your refresh token to ensure it matches that of your API key.

To update their prepaid meter tokens customers will receive two codes from Kenya Power when they purchase tokens. They will be required to key the codes to their meter following the steps indicated in the SMS before loading the new token.

What is the response for expired token? ›

If you attempt to use an expired token, you'll receive a "401 Unauthorized HTTP" response. When this happens, you'll need to refresh the access token. You shouldn't request a new token for every API call made, as each token is good for an hour and should be reused.

More specifically, how do you know if it has already expired or not? When you obtain an access token, the JSON that comes back when you make a request includes another property in addition to the token itself. It's called expired_in and that is how long, in seconds, you have before the token expires.

The differences between ID Tokens and Access Tokens

ID Tokens are JSON Web Tokens (JWT) that contain claims about a user's identity, such as their username, email, etc. Access Tokens are used to grant applications permission to access server resources on behalf of the user.

To get a refresh token , you must include the offline_access scope when you initiate an authentication request through the /authorize endpoint. Be sure to initiate Offline Access in your API. For more information, read API Settings.

When to use Refresh Tokens? The main purpose of using a refresh token is to considerably shorten the life of an access token. The refresh token can then later be used to authenticate the user as and when required by the application without running into problems such as cookies being blocked, etc.

If you want to extend the token lifetime beyond the default, you must create an organization policy that enables the iam. allowServiceAccountCredentialLifetimeExtension constraint. You can't create access tokens with an extended lifetime for user credentials or external identities.

You can configure token lifetimes in the Azure portal. Go to the Azure portal. In "Azure Active Directory" > "Security" > "Authentication methods" > "Authentication methods blade" > "Token Lifetime Policies". you can configure the lifetime of access tokens, refresh tokens, and ID tokens.

when the token expires and needs to be refreshed. To do this, provide tokenHandler for the SDK Builder. The handler should make a call to your backend, obtain a new access token, and then pass it back to the SDK by returning its value.