Tokens and lifetimes
What each token is for, how long it lasts and how refresh tokens rotate.
Connectez-vous pour voir votre propre ID client de test dans les exemples.
| Token | Lifetime | What it is for |
|---|---|---|
| Authorization code | 60 seconds, once | Swapped at the token endpoint, with the PKCE verifier |
| Access token | 15 minutes | Bearer for userinfo; typ is at+jwt, aud is your client ID |
| ID token | 5 minutes | Read once, by your app, to learn who signed in |
| Refresh token | 90 days unused, 1 year at most | Only with offline_access; each use returns a new one |
Refresh tokens rotate
Every refresh returns a new refresh token, and the old one stops working. If an old one is ever used again, we treat the line as stolen and end every token in it. Keep only the newest, and send one refresh at a time.
A refresh token expires after 90 days without use. However often it is used, a line of refresh tokens ends one year after the person signed in: the last refresh before then returns a token that expires on that day, and after it the person signs in again. Plan for that sign-in rather than treating it as an error.
Never mix them up
An ID token is not a credential: do not send it to an API. Userinfo refuses one. An access token says what may be reached, not who signed in to your app.
When access ends
A person can take back your access at any time. From that moment your refresh token stops working, userinfo refuses your access token, and you receive consent.revoked. The same happens if we suspend your app.
Demandez à Atlas
Assistant IAPosez n'importe quelle question sur Se connecter avec Atheron, l'API ou le portail. La réponse vient de notre documentation, avec les liens des pages utilisées.