Tokens and lifetimes
What each token is for, how long it lasts and how refresh tokens rotate.
Melden Sie sich an, um Ihre eigene Test-Client-ID in den Beispielen zu sehen.
| Token | Lifetime | What it is for |
|---|---|---|
| Authorization code | 60 seconds, once | Swapped at the token endpoint, with the PKCE verifier |
| Access token | 15 minutes | Bearer for userinfo; typ is at+jwt, aud is your client ID |
| ID token | 5 minutes | Read once, by your app, to learn who signed in |
| Refresh token | 90 days unused, 1 year at most | Only with offline_access; each use returns a new one |
Refresh tokens rotate
Every refresh returns a new refresh token, and the old one stops working. If an old one is ever used again, we treat the line as stolen and end every token in it. Keep only the newest, and send one refresh at a time.
A refresh token expires after 90 days without use. However often it is used, a line of refresh tokens ends one year after the person signed in: the last refresh before then returns a token that expires on that day, and after it the person signs in again. Plan for that sign-in rather than treating it as an error.
Never mix them up
An ID token is not a credential: do not send it to an API. Userinfo refuses one. An access token says what may be reached, not who signed in to your app.
When access ends
A person can take back your access at any time. From that moment your refresh token stops working, userinfo refuses your access token, and you receive consent.revoked. The same happens if we suspend your app.
Fragen Sie Atlas
KI-AssistentFragen Sie alles zu Mit Atheron anmelden, zur API oder zum Portal. Die Antwort kommt aus unserer Dokumentation, mit Links zu den genutzten Seiten.