# Implement session inactivity timeout

**URL:** <https://community.auth0.com/t/implement-session-inactivity-timeout/57673>\
**Category:** Get Help\
**Tags:** userinfo, rules\
**Created:** [February 10, 2021, 11:19am UTC](https://community.auth0.com/t/implement-session-inactivity-timeout/57673 "2021-02-10T11:19:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mbabayev](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mbabayev/32/19540_2.png) [@mbabayev](https://community.auth0.com/u/mbabayev)\
**Post date:** [February 10, 2021, 11:19am UTC](https://community.auth0.com/t/implement-session-inactivity-timeout/57673/1 "2021-02-10T11:19:52Z")

</div>

I want to Implement the session inactivity timeout by Rules.  
All our requests go to the “userInfo” endpoint. I need to save somewhere the timestamp of the previous userInfo request and run the rule at every new “userInfo” request to validate the saved timestamp and the user domain (can be taken from “user.email”).  
Is it possible accomplish that by the Rules?

---

<div class="post-metadata">

**Author:** ![sgo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sgo/32/13789_2.png) [@sgo](https://community.auth0.com/u/sgo)\
**Post date:** [February 27, 2021, 11:59am UTC](https://community.auth0.com/t/implement-session-inactivity-timeout/57673/2 "2021-02-27T11:59:41Z")

</div>

Hi @mbabayev , welcome to the community!

Is there a reason you couldn’t use the built in session inactivity lifetime settings? If you are currently only getting access tokens for the userinfo endpoint, you could register a custom API within Auth0 and configure the lifetime for Access tokens to something much shorter and appropriate for your use case?

> **[Configure Session Lifetime Settings](https://auth0.com/docs/manage-users/sessions/configure-session-lifetime-settings)**
>
> Describes how to configure session lengths and limits for a tenant using the Auth0 Dashboard or the Management API.

> **[Register APIs](https://auth0.com/docs/get-started/auth0-overview/set-up-apis)**
>
> Learn how to register APIs in the Auth0 Dashboard.

By setting your custom API’s identifier as the audience and a scope of `openid` in the `/authorize` requests, you can retrieve an access token that can be used against /userinfo and control its lifetime : [Get Access Tokens](https://auth0.com/docs/tokens/access-tokens/get-access-tokens#multiple-audiences)  
Once the user’s session expired from inactivity, they could no longer get a new Access Token and would have until their most recent token’s expiry was reached to call `/userinfo`

IMO this would be a cleaner solution than attempting something similar via rules.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 14, 2021, 11:59am UTC](https://community.auth0.com/t/implement-session-inactivity-timeout/57673/3 "2021-03-14T11:59:44Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.