Hey there, my company is making the switch to Auth0 and our main goal is ensuring that our users don’t have to log in if they are active during a 14 day period. If they continue to make calls and refresh their tokens, they should never be logged out. If they try to refresh a token outside of the 14 …

Have you configured your app to use refresh tokens? You need to tell the SDK to request one. From our docs: The getAccessTokenSilently() method can renew the access and ID token for you using refresh tokens . To get a refresh token when a user logs in, pass useRefreshTokens={true} as a prop to Auth…

Hi @projuljustin , Welcome to the Community! It depends on what type of application you are running (single page app, native app, traditional web app) and what plan you are on. This blog does a good job of laying out the app vs. plan types: [image] Balance User Experience and Security to…

We’re running an SPA and for our dev environment are on a free plan. Is there a certain plan we would need to keep users logged in indefinitely?

Enterprise customers have access to a long lived sessions feature, 100 Days Inactivity/365 Days Total Timeout.

To clarify the sessions, once your refresh token is expired you use the local or server side session to get a new refresh token. If you attempt to do this refresh and the session is expired, the user is logged out correct? So for a standard plan, any user will be logged out after 30 days + refresh …

[image] projuljustin: once your refresh token is expired you use the local or server side session to get a new refresh token. The existing refresh token is used to request a new refresh token (and access token). [image] projuljustin: If you attempt to do this refresh and the session is e…

Here is what I gathered from speaking to the team: The session settings and the refresh tokens are separate. The session settings ( Require log in after , Inactivity timeout) are specifically for the session cookie that is set after authentication. If you are using refresh token rotation, those li…

If I’m using refresh token rotation, and my session is expired, but my refresh token is not expired, will I still be authenticated and be able to get a new refresh and access token?

@dan.woda - I just had a scenario where a test user was logged out after ~3 days of inactivity after a getAccessTokenSilently() call failed with “Login required”. I see this function is supposed to use refresh tokens, but I don’t see a refresh token being used in the token request. We’re using the …

In the response I see we are only passed an access_token and an id_token. Since I have refresh token rotation turned on, shouldn’t a refresh token be returned too? [image] Authorization Code Flow with Proof Key for Code Exchange (PKCE) Learn how the Authorization Code flow with Proof Key…

How to stay logged in forever(ish)

Get Help

dan.woda May 24, 2021, 4:13pm 10

That is correct, yes.

3 day inactivity timeout on essential plan

Topic		Replies	Views
How to keep users logged in for longer? Get Help configuration , application	2	1240	August 23, 2023
3 day inactivity timeout on essential plan Get Help login-experience , new-universal-login-experience	1	1656	March 21, 2023
Log user out after inactivity Get Help login-experience , new-universal-login-experience	1	395	September 26, 2024
The user is logged out after one hour despite the use refresh tokens Get Help sessions , rotating-refresh-tokens	1	71	October 17, 2025
Authorization Code with PKCE flow for SPA with Refresh Token and idle timeout Get Help sessions , rotating-refresh-tokens	3	409	August 7, 2024

How to stay logged in forever(ish)

Related topics