# How to set different token validity periods for different applications **URL:** \ **Category:** Get Help\ **Tags:** apis, application\ **Created:** [September 6, 2023, 12:10am UTC](https://community.auth0.com/t/how-to-set-different-token-validity-periods-for-different-applications/115487 "2023-09-06T00:10:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![y-chibana](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@y-chibana](https://community.auth0.com/u/y-chibana)\ **Post date:** [September 6, 2023, 12:10am UTC](https://community.auth0.com/t/how-to-set-different-token-validity-periods-for-different-applications/115487/1 "2023-09-06T00:10:38Z")
Hi everyone. We are currently developing a product that has two types of login, one from a web application and the other from a native application, and we would like to have different validity periods for the bearer tokens for the web application and the native application. Is this possible? If so, we would like to know how to set it up. ---
**Author:** ![marcelina.barycka](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marcelina.barycka/32/56162_2.png) [@marcelina.barycka](https://community.auth0.com/u/marcelina.barycka)\ **Post date:** [September 6, 2023, 9:32am UTC](https://community.auth0.com/t/how-to-set-different-token-validity-periods-for-different-applications/115487/2 "2023-09-06T09:32:58Z")
Hey there @y-chibana ! Although it refers to SPA app, you may want to check this topic for reference - [Auth0 SPA Session TTL](https://community.auth0.com/t/auth0-spa-session-ttl/102017) Thanks! ---
**Author:** ![y-chibana](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@y-chibana](https://community.auth0.com/u/y-chibana)\ **Post date:** [September 7, 2023, 2:15am UTC](https://community.auth0.com/t/how-to-set-different-token-validity-periods-for-different-applications/115487/4 "2023-09-07T02:15:55Z")
Thank you marcelina.barycka for your reply. I have specified MaxAge for a WPF application built with .Net Framwrok 4.8, referring to your suggested post. My assumed result was that the opening between iat and exp in the access token would be the MaxAge value, but that doesn’t seem to be the case. The value of exp is the same as it was before I specified MaxAge, is this correctly adjusting the validity period? ---
**Author:** ![marcelina.barycka](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marcelina.barycka/32/56162_2.png) [@marcelina.barycka](https://community.auth0.com/u/marcelina.barycka)\ **Post date:** [September 7, 2023, 11:04am UTC](https://community.auth0.com/t/how-to-set-different-token-validity-periods-for-different-applications/115487/5 "2023-09-07T11:04:16Z")
Thanks for following up! Would you mind sharing what Auth0’s SDK you use to adjust the /authorize request with the max\_age (or maxAge) parameter? Then we could dive into the library docs which could give us some good pointers. This topic can be also relevant - [How to enforce re-authentication for sensitive operations? - #2 by amaanc](https://community.auth0.com/t/how-to-enforce-re-authentication-for-sensitive-operations/6056/2) Looking at the OIDC standard - specifying the [max\_age](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest) in the /authorize request results in the **ID token** being equipped with the `auth_time` claim. > **max\_age** > OPTIONAL. Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP. If the elapsed time is greater than this value, the OP MUST attempt to actively re-authenticate the End-User. (The max\_age request parameter corresponds to the OpenID 2.0 PAPE [OpenID.PAPE] max\_auth\_age request parameter.) When max\_age is used, the ID Token returned MUST include an auth\_time Claim Value. > auth\_time > Time when the End-User authentication occurred. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time. When a max\_age request is made or when auth\_time is requested as an Essential Claim, then this Claim is REQUIRED; otherwise, its inclusion is OPTIONAL. (The auth\_time Claim semantically corresponds to the OpenID 2.0 [PAPE](https://openid.net/specs/openid-connect-core-1_0.html#OpenID.PAPE) [OpenID.PAPE] auth\_time response parameter.) > If the auth\_time Claim was requested, either through a specific request for this Claim or by using the max\_age parameter, the Client SHOULD check the auth\_time Claim value and request re-authentication if it determines too much time has elapsed since the last End-User authentication. * * * [📹 _Prefer how-to videos instead of written docs? We’ve got you covered! Check out our OktaDev YouTube channel for those helpful resources!_](https://www.youtube.com/@OktaDev/videos) —---------------------------------------------------------------------------------------------------------------------------- ---
**Author:** ![y-chibana](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@y-chibana](https://community.auth0.com/u/y-chibana)\ **Post date:** [September 11, 2023, 7:22am UTC](https://community.auth0.com/t/how-to-set-different-token-validity-periods-for-different-applications/115487/6 "2023-09-11T07:22:43Z")
Thanks for getting back to me. First, I would like to correct an error in my previous response. The native app is built with WinForms, not WFP. I am using version 3.5.0 of Auth0.OidcClient.WinForms, which is published as a Nuget package. I thought this would be reflected in the access token exp, but after reviewing this response, I understand that this is incorrect. I also confirmed that the ID token contains the result of auth\_time. However, a new question arises. Since it is the access token that is sent from the native app to the API server, I don’t think the server can determine if the access token is still valid. Is it not possible to check the specified validity period on the server side? I know this is more of a general authentication mechanism than Auth0, but it would be helpful to know. ---
**Author:** ![marcelina.barycka](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marcelina.barycka/32/56162_2.png) [@marcelina.barycka](https://community.auth0.com/u/marcelina.barycka)\ **Post date:** [September 13, 2023, 11:59am UTC](https://community.auth0.com/t/how-to-set-different-token-validity-periods-for-different-applications/115487/7 "2023-09-13T11:59:26Z")
> [@y-chibana](#): > > Since it is the access token that is sent from the native app to the API server, I don’t think the server can determine if the access token is still valid. I think this [article](https://auth0.com/docs/authenticate/login/max-age-reauthentication) may bring some additional context. Specifically the following statement: > This extra validation will need to be covered by application authors and frameworks making use of the max\_age parameter. Also: > Don’t rely on client-side verification (i.e. in the browser) of the ID token or auth\_time to prevent sensitive operations. (_My interpretation_) The middleware (on the API server side) responsible for the incoming access token validation and parsing could potentially make use of some of the relevant for the access token validation data, like: - time when the request to gain protected data has been sent; - “issued at” claim of the access token; - max\_age parameter value; - “issued at” claim of the ID token; - “auth\_time” claim in the ID token; - current time; and perform validation by making relevant comparisons. Does this give you some good directions for your investigation? * * * [📹 _Want to join our next Community Interactive Q&A with our experts? This time we’re gonna talk about Auth0 Terraform Provider_](https://community.auth0.com/t/ask-me-anything-with-auth0-terraform-provider/115670) ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [September 27, 2023, 12:00pm UTC](https://community.auth0.com/t/how-to-set-different-token-validity-periods-for-different-applications/115487/8 "2023-09-27T12:00:13Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.