Hi team,
We’re trying to understand how last_interacted_at should be used for implementing user inactivity timeouts.
From our observations, the value appears to be continuously updated with the latest interaction timestamp, for example:
“last_interacted_at”: “2026-07-27T06:55:21.428Z”
Because this field always reflects the most recent interaction, we’re unclear on how it can be used to reliably calculate an inactivity period (for example, automatically logging a user out after 30 minutes of inactivity using post-login action).|
Hi @arpita.vyas23
Thank you for reaching out to us!
I understand that you would like to know the use of the last_interacted_at property and how can you calculate an inactivity period.
Because last_interacted_at continuously updates to reflect the most recent interaction (including the current login transaction), it cannot reliably measure the time elapsed since the previous interaction. Auth0’s session engine is designed to handle inactivity automatically without requiring manual calculation in a post-login action.
Recommended Action
To implement a 30-minute user inactivity timeout, rely on Auth0’s built-in session management instead of manual calculation:
-
For global enforcement: Navigate to your Tenant Settings > Advanced > Login Session Management (or your specific Application settings) and set the Inactivity timeout to 30 minutes. Auth0 will automatically expire the session if no interaction with the Authorization Server occurs within that timeframe.
-
For dynamic enforcement (via Actions): If you only want the 30-minute inactivity timeout applied under specific conditions, use the api.session.setIdleExpiresAt(idle) method in your post-login action to dynamically pass a new expiration date object. Auth0 will enforce this idle timeout until the next successful interaction.
Hope this helped you take the best course of action!
Have a great one,
Gerald