Okta Refresh Token Expiration Behavior and Configuration
Last Updated:
Overview
When an application uses an expired refresh token, Okta generates an HTTP 400 error at the /token endpoint and automatically signs users out of the application. This occurs because the refresh token exceeds its configured absolute lifetime or its idle expiration window. Reviewing the authorization server access policies and understanding token lifetimes ensures the application handles token rotation correctly.
HTTP 400: The refresh token is invalid or expired.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC) Applications
- Authorization Code Flow
- Resource Owner Password Flow
Cause
This error occurs because the refresh token exceeds its configured absolute lifetime or its idle expiration window. When the token expires, Okta rejects subsequent token requests and requires the user to re-authenticate.
Solution
How does Okta determine the refresh token expiration time?
After authenticating and receiving a refresh token, the token's expiration date depends on its configured lifetime. When an application uses a refresh token, and Okta provides a new refresh token, the expiration time remains the same as the previous token. Administrators determine the exact expiration time of a refresh token by querying the /introspect endpoint.
What are the refresh token lifetime limits for Okta authorization servers?
The refresh token lifetime limits vary depending on the type of authorization server used.
- On an Org Authorization Server, the refresh token lifetime is strictly 90 days, and Okta does not enforce an idle refresh token time.
- On a Custom Authorization Server, administrators configure the refresh token lifetime to a value between 10 minutes and 5 years, or set it to no lifetime (unlimited). Custom authorization servers also include a setting that expires tokens after a specific period of inactivity. If the application fails to rotate the access token and the refresh token within that idle time, both tokens automatically expire.
How do access policies affect token lifetimes on a Custom Authorization Server?
Review the following example of an access policy on a Custom Authorization Server and the corresponding details regarding the access token and refresh token lifetimes based on this policy.
- The access tokens Okta returns remain valid for up to 10 minutes. After 10 minutes, the access token expires, and the application must use a refresh token to retrieve a new access token that lasts for another 10 minutes.
- The refresh tokens possess a total lifetime of 45 minutes. After 45 minutes from the initial authentication, the refresh token expires. At this point, Okta requires the user to re-authenticate to obtain a new set of tokens.
- If the application fails to use the refresh token within 30 minutes, the token expires, and Okta requires the user to re-authenticate for a new set of tokens.
NOTE: The idle refresh token lifetime (expiration window) must fall between the access token lifetime and the refresh token lifetime.
