# PKCE vs credentials grant token lifetime **URL:** \ **Category:** Get Help\ **Tags:** implicit-grant, jwt, client-credentials-g\ **Created:** [April 30, 2021, 12:25am UTC](https://community.auth0.com/t/pkce-vs-credentials-grant-token-lifetime/61990 "2021-04-30T00:25:49Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![corylogan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/corylogan/32/29137_2.png) [@corylogan](https://community.auth0.com/u/corylogan)\ **Post date:** [April 30, 2021, 12:25am UTC](https://community.auth0.com/t/pkce-vs-credentials-grant-token-lifetime/61990/1 "2021-04-30T00:25:49Z")
We have two types of authentication to an API. - One is where users log in through a react app on the web using the `@auth0/auth0-react` package, PKCE grant. - The other type is machine to machine access using a client credentials grant flow. We are trying to configure two different token lifetimes for these two different flows. Here’s how we have it configured in the yaml config: ``` token_lifetime: 86400 token_lifetime_for_web: 1800 ``` So, basically we want our web clients to have a token timeout of 30 minutes and our M2M tokens to have a timeout of 1 day. The problem: when we log in using the web flow it uses the `token lifetime` value for our web tokens. We were surprised as there is a configuration value specifically for web. Is there some way to get our React app to use tokens with a lifetime shorter than the token lifetime used by M2M applications? Thanks community! 🙂 ---
**Author:** ![sgo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sgo/32/13789_2.png) [@sgo](https://community.auth0.com/u/sgo)\ **Post date:** [April 30, 2021, 2:20pm UTC](https://community.auth0.com/t/pkce-vs-credentials-grant-token-lifetime/61990/2 "2021-04-30T14:20:27Z")
Hi @corylogan , welcome to the community! PKCE flows use the `token_lifetime` setting and is expected. The “Token expiration for Browser Flows” / `token_lifetime_for_web` option is only used for Implicit and Hybrid flows: > **[Update Access Token Lifetime](https://auth0.com/docs/secure/tokens/access-tokens/update-access-token-lifetime)** > > Describes how to update the access token lifetime for an API using the Auth0 Dashboard. ---
**Author:** ![corylogan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/corylogan/32/29137_2.png) [@corylogan](https://community.auth0.com/u/corylogan)\ **Post date:** [May 1, 2021, 12:13am UTC](https://community.auth0.com/t/pkce-vs-credentials-grant-token-lifetime/61990/3 "2021-05-01T00:13:03Z")
Thanks so much for the input @sgo. So, wondering then, how can we have different token lifetimes for our M2M tokens and our PKCE tokens? Is that not possible? We have security requirements for our web facing applications, but we don’t want to burn tons of M2M tokens as we have a monthly quota to try and stay under. Thanks! ---
**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\ **Post date:** [May 3, 2021, 4:41pm UTC](https://community.auth0.com/t/pkce-vs-credentials-grant-token-lifetime/61990/4 "2021-05-03T16:41:47Z")
Hey @corylogan I don’t think this is possible easily - the token expiration is associated with the API, not the application. You CAN do this by defining two different APIs in Auth0, one for the M2M application and one for the user facing app. Your actual API would then have to accept both kinds of tokens (they would have different audiences, but the same signing keys) John ---
**Author:** ![corylogan](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/corylogan/32/29137_2.png) [@corylogan](https://community.auth0.com/u/corylogan)\ **Post date:** [May 3, 2021, 5:46pm UTC](https://community.auth0.com/t/pkce-vs-credentials-grant-token-lifetime/61990/5 "2021-05-03T17:46:52Z")
@john.gateley I’ll confess, I don’t love it. But this is a workable solution! So thanks so much for that! We may go about implementing it like this. Cheers, Cory ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [May 4, 2021, 9:45am UTC](https://community.auth0.com/t/pkce-vs-credentials-grant-token-lifetime/61990/6 "2021-05-04T09:45:48Z")
Glad we have some kind of solution! Teamwork makes the dreamwork! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [May 19, 2021, 9:46am UTC](https://community.auth0.com/t/pkce-vs-credentials-grant-token-lifetime/61990/7 "2021-05-19T09:46:30Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.