Authentication Access token life time

[Joy033]

Can I set access_token expires_in time for 3-5 yrs or infinite years when we connect for Fitbit for Api access?

[Gordon-C]

Hi @Joy033 

If using the Implicit Grant Flow, the maximum lifetime of the access_token is 1 year.  Afterwards, a user will need to re-authorize your application.

if using the Authorization Code Grant Flow, the maximum lifetime of the access_token is 8 hours.  When the access token expires, you can use the refresh token to obtain a new access_token/refresh_token pair.  The user will not need to re-authorize your application.  This method of using the refresh token to obtain a new access_token/refresh_token can occur indefinitely in your application.

The Implicit Grant Flow does not provide you with a refresh_token.