How long should token last?

How Long Should a Token Last?

When it comes to token-based authentication, one of the most important questions is how long a token should last. The answer to this question depends on various factors, including the type of token, the application’s security requirements, and the user’s experience. In this article, we will explore the different types of tokens, their typical lifetimes, and the considerations that should be taken into account when determining the length of time a token should be valid.

Default Token Lifetimes

By default, access tokens are valid for 60 days, while programmatic refresh tokens are valid for a year. This means that once a user grants an application permission to access their data, the application can use the access token to make requests to the API for a period of 60 days. If the user revokes the application’s permission or the token expires, the application can use the refresh token to obtain a new access token.

Bearer Tokens

Bearer tokens, on the other hand, have a shorter lifetime of 60 minutes. This is because bearer tokens are designed to be used for a single request and are not intended to be reused. When a bearer token is used, it is immediately invalid and cannot be used again.

JSON Web Tokens (JWT)

JSON Web Tokens (JWT) have a lifetime that is determined by the issuer. In the case of the Org Authorization Server, JWTs have a lifetime of 60 minutes. This means that once a JWT is issued, it can be used for a period of 60 minutes before it expires.

Refresh Tokens

Refresh tokens, as mentioned earlier, have a lifetime of a year. This means that once a user grants an application permission to access their data, the application can use the refresh token to obtain a new access token every 60 days.

Token Renewal

Token renewal is the process of obtaining a new token when the existing token is about to expire. This can be done using a refresh token, which can be used to obtain a new access token. Token renewal is important because it ensures that the application can continue to make requests to the API even after the original token has expired.

Token Revocation

Token revocation is the process of invalidating a token that has been compromised or is no longer needed. This can be done by the user or by the application. When a token is revoked, it is immediately invalid and cannot be used again.

Best Practices for Token Lifetimes

When determining the length of time a token should be valid, there are several best practices that should be followed:

• Use a reasonable lifetime: The lifetime of a token should be reasonable and not too long or too short. A lifetime of 60 days is a good starting point.
• Use a refresh token: Refresh tokens should be used to obtain a new access token when the existing token is about to expire.
• Implement token renewal: Token renewal should be implemented to ensure that the application can continue to make requests to the API even after the original token has expired.
• Implement token revocation: Token revocation should be implemented to ensure that compromised or no longer needed tokens are invalidated.

Conclusion

In conclusion, the length of time a token should last depends on various factors, including the type of token, the application’s security requirements, and the user’s experience. By following best practices and implementing token renewal and revocation, applications can ensure that tokens are used securely and efficiently.

Token Lifetimes at a Glance

Token Renewal and Revocation

I hope this article has provided a comprehensive overview of token lifetimes and best practices for token-based authentication.