How to stay logged in forever(ish)

[dan.woda]

@projuljustin

once your refresh token is expired you use the local or server side session to get a new refresh token.

The existing refresh token is used to request a new refresh token (and access token).

@projuljustin

If you attempt to do this refresh and the session is expired, the user is logged out correct?

If the absolute lifetime for the family of refresh tokens is expired the user is forced to authenticate.

From the docs:

• Absolute Lifetime : Set a refresh token or refresh token family lifetime after which the user must re-authenticate before being issued a new access token.

@projuljustin

So for a standard plan, any user will be logged out after 30 days + refresh token expiration, correct?

I will have to check on this.

@projuljustin

In theory, if you set the refresh token to something really long like 90 days, they would be logged in for 90 days, the refresh would expire, and the session is already expired, they would be signed out. Correct?

I think this goes back to the previous question, whether or not the Login Session settings supersede the token lifetimes and force logout. I’ll ask the team and get back to you.