# Auth0 Session Lifetime

**URL:** <https://community.auth0.com/t/auth0-session-lifetime/59055>\
**Category:** Get Help\
**Tags:** refresh-tokens, auth0\
**Created:** [March 8, 2021, 10:30am UTC](https://community.auth0.com/t/auth0-session-lifetime/59055 "2021-03-08T10:30:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![claus](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/claus/32/8905_2.png) [@claus](https://community.auth0.com/u/claus)\
**Post date:** [March 8, 2021, 10:30am UTC](https://community.auth0.com/t/auth0-session-lifetime/59055/1 "2021-03-08T10:30:23Z")

</div>

I see new settings for rotating refresh tokens, as well as absolute token lifetime and inactivity lifetime settings. I have read your article here: [Achieving a Seamless User Experience with Refresh Token Inactivity Lifetimes](https://auth0.com/blog/achieving-a-seamless-user-experience-with-refresh-token-inactivity-lifetimes/)

One big issue we are having as a non-enterprise user of Auth0 is the 3 days of inactivity session limit and also the 30 day absolute limit. This is costing us many users.

However, I see I can set absolute lifetime to 365 days (31557600s) and inactivity lifetime to 30 days (2591999s). This is on our unpaid plan.

Yet I still read [here](https://auth0.com/docs/sessions-and-cookies) that session lifetime is max 3 and 30 days for non-enterprise users.

So which is right? Can I now set these lifetimes in the auth0 panel and get longer sessions or will these settings be ignored. Confused.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [March 8, 2021, 11:09pm UTC](https://community.auth0.com/t/auth0-session-lifetime/59055/3 "2021-03-08T23:09:48Z")

</div>

Hi @claus,

The doc you linked is correct, the session lifetimes are as follows:

> - **Inactivity timeout** : Timeframe after which a user’s session will expire if they haven’t interacted with the Authorization Server. Will be superseded by system limits if over 3 days for self-service plans or 100 days for enterprise plans.
> - **Require log in after** : Timeframe after which a user will be required to log in again, regardless of their activity. Will be superseded by system limits if over 30 days for self-service plans or 365 days for enterprise plans.

Specifically: “ **Will be superseded by system limits** ”

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 23, 2021, 11:10pm UTC](https://community.auth0.com/t/auth0-session-lifetime/59055/4 "2021-03-23T23:10:36Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.