Do OAuth 1.0a user access tokens expire?

[JeremiahFitbit]

OAuth 1.0a user access tokens do not expire. However, a user may revoke access to your application from their application settings page. Also, if a user re-authorizes your application, previously granted access tokens will be invalidated.

[snobben]

Is this a new behaviour? The old tokens did not use to expire when a user re-authorized an app. When did this change take effect?

[ibahdanau]

The change is in effect since hearbleed bug(http://heartbleed.com/) discovered back in April 2014.

[ecbrodie]

---

@JeremiahFitbit wrote:

OAuth 1.0a user access tokens do not expire.

---

I would like to confirm, is this quote still valid? IE, if I am making a web service that requires our users to "link" their fitbit accounts to our service via OAuth access tokens, can we ensure that the access token will last indefinitely without require re-authentication from the user?

[ibahdanau · Accepted solution]

The access token will never expire unless user revokes access to your app.

[ecbrodie]

Thank you!

[freeubi]

Are you sure?

My tokens expire in one hour after the authentication. 
I use my own fitbit account so i know that i'm not revoking the access.

[JeremiahFitbit]

---

@freeubi wrote:

Are you sure?

My tokens expire in one hour after the authentication. 
I use my own fitbit account so i know that i'm not revoking the access.

---

Sounds like you're not doing the final access token exchange and you're using your request token.

[freeubi]

Nope, i'm doing all the steps, i exchange the first tokens to the permanent token.

[ibahdanau]

It's 100% given that tokens once issued currently are ONLY expired when user revokes access.

If you somehow observing that your tokens are expiring I there is probably something wrong with the oauth 1.0a flow you're implementing.

The temporary tokens expire approx in 24 hours though, but I guess you were talking about permanen acces tokens.

[6hoursdaily]

Hi guys, wondering if this still holds true:

---

@JeremiahFitbit wrote:

OAuth 1.0a user access tokens do not expire. However, a user may revoke access to your application from their application settings page. Also, if a user re-authorizes your application, previously granted access tokens will be invalidated.

---

I've tried re-authorizing my Fitbit account under the same application and both authentications seem to return the same user access tokens.

The problem is that with both authentications active in my system (and potentially many more authentications if the scenario is recreated multiple times), my system hits the Fitbit API multiple times given each authentication remains valid, making it hit the user's rate limit.

Thanks!

[JeremiahFitbit · Accepted solution]

@6hoursdaily: We have momentarily disabled new access token generation when the authorization has not changed (meaning, it has not been revoked by the user). You should use the Fitbit user id, not the access token, to identify a Fitbit user.

[smooxer]

Do oauth1-tokens still not expire? Are there plans to change this behaviour in the future?