# Auth0 SPA Session TTL **URL:** \ **Category:** JWT.io\ **Tags:** jwt, access-token\ **Created:** [March 7, 2023, 8:42pm UTC](https://community.auth0.com/t/auth0-spa-session-ttl/102017 "2023-03-07T20:42:41Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![joe.a](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/joe.a/32/35942_2.png) [@joe.a](https://community.auth0.com/u/joe.a)\ **Post date:** [March 7, 2023, 8:42pm UTC](https://community.auth0.com/t/auth0-spa-session-ttl/102017/1 "2023-03-07T20:42:42Z")
It seems that every auth session lifetime, and issuance of access tokens is related to the values set for the Login Session Management in the tenant. If a user is authenticated and has a login session they can get access and id tokens. Given 3 separate SPA applications in the same tenant, is there a way to have different auth session TTLs for each application? We can adjust the TTL of the ID and Refresh Tokens in the Application, and the TTL of the Access token in the API, but it seems like the TTL of the login session is what ultimately matters. Is this accurate and/or is there an approach to have different applications with different session lengths? Thanks! ---
**Author:** ![nicolas\_sabena](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nicolas_sabena/32/6064_2.png) [@nicolas\_sabena](https://community.auth0.com/u/nicolas_sabena)\ **Post date:** [March 11, 2023, 12:54am UTC](https://community.auth0.com/t/auth0-spa-session-ttl/102017/2 "2023-03-11T00:54:10Z")
Individual applications can use the `max_age` parameter in the authorization request if they have specific requirements. E.g. you can have a tenant-wide session length of 3 days but a single application with stricter requirements specifying `max_age=28800` (8 hours). If the last authentication happened before 8 hours, Auth0 will force the user to re-authenticate. Applications should check the `auth_time` of the ID token to ensure that the received token corresponds to the requested `max_age` (and no one altered the request). Most SDKs/OIDc middlewares should check that for you. See [Force Reauthentication in OIDC](https://auth0.com/docs/authenticate/login/max-age-reauthentication#max_age-authentication-request-parameter) for details. ---
**Author:** ![joe.a](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/joe.a/32/35942_2.png) [@joe.a](https://community.auth0.com/u/joe.a)\ **Post date:** [March 13, 2023, 7:32pm UTC](https://community.auth0.com/t/auth0-spa-session-ttl/102017/3 "2023-03-13T19:32:00Z")
Thank you for the reply. This is great. I tested locally and verified that authorization is required after the max\_age TTL. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 27, 2023, 7:32pm UTC](https://community.auth0.com/t/auth0-spa-session-ttl/102017/4 "2023-03-27T19:32:12Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.