# Native app expires\_at value is always 12 or 24 hours **URL:** \ **Category:** Get Help\ **Tags:** clients, management-api\ **Created:** [December 14, 2022, 3:53pm UTC](https://community.auth0.com/t/native-app-expires-at-value-is-always-12-or-24-hours/96462 "2022-12-14T15:53:13Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![sb.bt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sb.bt/32/33507_2.png) [@sb.bt](https://community.auth0.com/u/sb.bt)\ **Post date:** [December 14, 2022, 3:53pm UTC](https://community.auth0.com/t/native-app-expires-at-value-is-always-12-or-24-hours/96462/1 "2022-12-14T15:53:13Z")
When I login to my native Android application using Auth0, the expires\_at value from the Credentials object is always: - 12 hours, when the scope **does not** include offline\_access - 24 hours, when the scope **does** include offline\_access However, this is despite me setting the ID token and access token to both be 60 seconds. ![ID token expiry](https://global.discourse-cdn.com/auth0/original/3X/d/c/dced70fe889a40a68ac711b16f3427e2c01ab788.png) ![Access token expiry](https://global.discourse-cdn.com/auth0/original/3X/d/4/d42de30b4fd89fae8db78395945c64d8fd3d8ce6.jpeg) However, this is not the only issue. When I receive the tokens and decode them, the ID token does expire in 60 seconds but the access token expires in 1 hour - not the 60 seconds that was stated in the Auth0 Management API. This is causing an issue with our setup as our developers looking after our Auth0 configuration are setting it as we want, but our native apps are not receiving those values 1. Why does the access token expiry not follow what I’ve put in the Auth0 Management API 2. Why does the expires\_at value in the Credentials object default to 24 or 12 hours, which is very far off the 60 seconds that we want? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [December 15, 2022, 3:13pm UTC](https://community.auth0.com/t/native-app-expires-at-value-is-always-12-or-24-hours/96462/3 "2022-12-15T15:13:54Z")
Hi @sb.bt Welcome to the Auth0 Community! > [@sb.bt](#): > > Why does the access token expiry not follow what I’ve put in the Auth0 Management API Are you requesting Management API tokens? The token expiry you set in your API settings _only applies to tokens issued for that API_. Keep in mind, the Management API =/= the Authentication API. > [@sb.bt](#): > > Why does the expires\_at value in the Credentials object default to 24 or 12 hours, which is very far off the 60 seconds that we want? This may be controlled by [Configure Session Lifetime Settings](https://auth0.com/docs/manage-users/sessions/configure-session-lifetime-settings). ---
**Author:** ![sb.bt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sb.bt/32/33507_2.png) [@sb.bt](https://community.auth0.com/u/sb.bt)\ **Post date:** [December 16, 2022, 12:08pm UTC](https://community.auth0.com/t/native-app-expires-at-value-is-always-12-or-24-hours/96462/4 "2022-12-16T12:08:27Z")
Hi @dan.woda, Thanks for your quick reply to my issue. So I was following [this documentation](https://auth0.com/docs/secure/tokens/access-tokens/update-access-token-lifetime) to set the access token expiry, which is why I thought Auth0 Management Api (which was the default API when I created the application). If this is wrong, can you provide more insight into how to get access to the Authentication API. The documentations ([this](https://auth0.com/docs/secure/tokens/id-tokens/update-id-token-lifetime) and [this](https://auth0.com/docs/secure/tokens/access-tokens/update-access-token-lifetime)) state it is really simple to change the expiry of the id and access tokens, but only id token is adhered to. That said, even though access token comes back with 1 hour expiry, the SDK gives back 24 hours. Unfortunately after changing the value in Configure Session Lifetime Settings, the `expires at` value still comes back as 24 hours. ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [December 16, 2022, 3:54pm UTC](https://community.auth0.com/t/native-app-expires-at-value-is-always-12-or-24-hours/96462/5 "2022-12-16T15:54:43Z")
> [@sb.bt](#): > > So I was following [this documentation](https://auth0.com/docs/secure/tokens/access-tokens/update-access-token-lifetime?_gl=1*13i9wga*rollup_ga*MTc4MDE1NjU0Ny4xNjY2MTE5OTcy*rollup_ga_F1G3E656YZ*MTY3MTIwMzQwMi45OC4xLjE2NzEyMDU1NDAuNDAuMC4w&_ga=2.97944543.1702807520.1670856751-77285757.1665695105) to set the access token expiry, which is why I thought Auth0 Management Api (which was the default API when I created the application). Tokens are issued to _specific APIs (resource servers)_, determined by the `audience` you include with your request initial request to authorize. A good place to start would be; _What are doing with your access tokens?_ ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [January 30, 2023, 9:41pm UTC](https://community.auth0.com/t/native-app-expires-at-value-is-always-12-or-24-hours/96462/6 "2023-01-30T21:41:49Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.