OAuth2 Token Lifetime — Configuring Access Token, Refresh Token, and ID Token Lifetimes

In this tutorial, you will learn about OAuth2 Token Lifetime. We cover key concepts, practical examples, and best practices to help you master this topic.

OAuth2 token lifetime configuration balances security and usability by setting appropriate expiry for access tokens, refresh tokens, and ID tokens based on the risk profile of your application.

What You'll Learn

• Access token TTL best practices
• Refresh token expiration and sliding sessions
• ID token lifetime for Openid Connect
• Token lifetime strategies per client type
• Refresh token rotation TTL

Why It Matters

Tokens that live too long increase the Blast Radius of token theft. Tokens that expire too quickly frustrate users with frequent re-authentication. DodaTech uses different token lifetimes per client type: 15-minute access for web apps, 5-minute access for mobile, and 24-hour refresh for trusted internal services.

flowchart LR
    A["Token Lifetime by Security Level"] --> B["Critical (financial, healthcare)"]
    A --> C["Standard (SaaS applications)"]
    A --> D["Low risk (read-only, public data)"]

    B --> B1["Access: 5 min"]
    B --> B2["Refresh: 1 hour"]
    B --> B3["Refresh rotation: yes"]

    C --> C1["Access: 15 min"]
    C --> C2["Refresh: 7 days"]
    C --> C3["Refresh rotation: yes"]

    D --> D1["Access: 1 hour"]
    D --> D2["Refresh: 30 days"]
    D --> D3["Refresh rotation: optional"]

What's Next

Configure lifetimes in your {{< ilink "OAuth" "OAuth2 Authorization Server" }} and explore {{< ilink "OAuth" "OAuth2 Refresh Tokens" }} for rotation patterns.