Cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How come I am able to use the access token but not refresh token?

After refreshing there is a 2 minute grace period where the refresh token will work. How come the access token still works for the expired refresh token? Do refresh tokens expire 2 minutes after they are used but access tokens expire 1 hour after they are issued irrespective of what happens to its refresh token? 

Best Answer
0 Votes
1 REPLY 1

For the purpose of this reply, "access token" will refer to refreshable access tokens obtained via the Authorization Code Grant Flow. Access token behavior is different for other flows.

 

Access and refresh token lifetimes are independent of each other.

 

Access tokens always have a 1 hour lifetime from the point when they were issued.

 

Refresh tokens live until 2 minutes after they are first used. Think of refresh tokens as a way to get a new access token, not as a way to replace an existing access token. If you use a refresh token to obtain a new access token before the current access token expires, you'll have two valid access tokens with different expiration times. We strongly recommend not relying on this behavior and only using the most recent access token obtained.

 

If the app authorization is revoked, it will cause the access and refresh tokens to be invalid immediately.

Best Answer
0 Votes