04-08-2016 11:08
04-08-2016 11:08
After refreshing there is a 2 minute grace period where the refresh token will work. How come the access token still works for the expired refresh token? Do refresh tokens expire 2 minutes after they are used but access tokens expire 1 hour after they are issued irrespective of what happens to its refresh token?
04-08-2016 11:25
04-08-2016 11:25
For the purpose of this reply, "access token" will refer to refreshable access tokens obtained via the Authorization Code Grant Flow. Access token behavior is different for other flows.
Access and refresh token lifetimes are independent of each other.
Access tokens always have a 1 hour lifetime from the point when they were issued.
Refresh tokens live until 2 minutes after they are first used. Think of refresh tokens as a way to get a new access token, not as a way to replace an existing access token. If you use a refresh token to obtain a new access token before the current access token expires, you'll have two valid access tokens with different expiration times. We strongly recommend not relying on this behavior and only using the most recent access token obtained.
If the app authorization is revoked, it will cause the access and refresh tokens to be invalid immediately.