Question about ID token and access token with auth0-nextjs

[rueben.tiow]

Hi @alexp,

Welcome to the Auth0 Community!

@alexp

When will the user be required to log in again: when the ID token expires, or when the access token expires?

The user will be required to log in again once the access token expires.

@alexp

Does it make any sense for the ID token and access token to have different expiration times?

Yes, it does make sense because they serve different purposes and do not interact with each other. Since access tokens are used for authentication to allow access to an API, they would typically have longer lifetimes using refresh tokens for extended access.

Whereas, ID tokens are used for authentication to cache user profile information. The session lifetime for ID tokens is typically short-lived for security reasons.

I hope that answers your questions, let me know if you have any more.

Thanks,
Rueben