The Refresh Token lifetime in the Access Policy is governed by two key parameters:
- Idle Lifetime, which resets each time the token is used.
- Max Lifetime, which defines the maximum expiration time.
When introspecting the token, the exp claim reflects the Idle Lifetime, but it cannot extend beyond the Max Lifetime, ensuring the token expires within the configured limits.
- OIDC/OAuth Tokens
- Refresh Tokens
- API Access Management
- Okta Classic Engine
- Okta Identity Engine (OIE)
While configuring Refresh Tokens in the Access Policy, there are two places where the lifetime of Refresh Token is configured:
- The Total Lifetime of Refresh Token marked by 1 in the screenshot.
- The Idle Lifetime of Refresh Token marked by 2 in the screenshot.
When using the Introspect Endpoint to introspect the Refresh token, the exp claim will point towards the Idle Lifetime of the Refresh Token. The expiration (exp) of a Refresh Token is updated each time the Refresh Token is used to renew access tokens. However, the exp time cannot exceed the Max Lifetime of the Refresh Token, which is set at the time of its issuance.
Example Scenario
- Initial Token Issuance: Tokens will be distributed at 4:00 PM.
- Idle Lifetime of the Refresh Token: 10 minutes.
- Max Lifetime of the Refresh Token: 30 minutes.
The following table outlines how the expiration of the Refresh Token is updated at different stages:
| Time | Action | Refresh Token Expiry (exp) | Explanation |
|---|---|---|---|
| 4:00 PM | Initial issuance of Refresh Token | 4:10 PM | Refresh Token is issued with an Idle Lifetime of 10 minutes. |
| 4:10 PM | Use Refresh Token to renew access token | 4:20 PM | The exp is updated to reflect the new time (10 minutes from the time of renewal). |
| 4:20 PM | Use Refresh Token to renew access token | 4:30 PM | The exp is updated again, now reflecting 10 minutes from the latest use. |
| 4:23 PM | Use Refresh Token again | 4:30 PM | Even though it's within the Idle Lifetime, the exp cannot exceed the Max Lifetime (30 minutes from the initial issue time), so it stays at 4:30 PM. |
| 4:25 PM | Use Refresh Token again | 4:30 PM | No change to exp as the Max Lifetime has been reached (30 minutes from 4:00 PM). |
Key Points
- Idle Lifetime: The
exptime can be refreshed within the Idle Lifetime, but will not exceed the Max Lifetime. - Max Lifetime: The Refresh Token has a fixed Max Lifetime (for example, 30 minutes from issuance), and once this is reached, the
expcannot extend further.
NOTE: When using Org Authorization Server to mint Refresh Tokens, the Introspect Endpoint will return the fixed Max Lifetime of 90 Days (there is no idle lifetime).
