Okta Refresh Token Idle Lifetime Explanation
Last Updated:
Overview
Administrators configure the lifetime of access tokens and refresh tokens on a custom authorization server to a specific value or set them to unlimited. The idle refresh token lifetime setting forces tokens to expire after a designated period of inactivity. The expiration window must fall between the access token lifetime and the refresh token lifetime, with a maximum limit of 1825 days.
Applies To
- OpenID Connect (OIDC) Applications
- Authorization Code
- Resource Owner Password
- Okta Identity Engine (OIE)
- Okta Classic Engine
Solution
How does the idle refresh token lifetime setting function?
Administrators can set the lifetime of the access token and refresh token to a custom value or to no lifetime on a custom authorization server.
Additionally, administrators configure a setting that forces tokens to expire after a specific period of inactivity. Okta enforces specific rules for the idle refresh token lifetime.
The expiration window must fall between the access token lifetime and the refresh token lifetime. The expiration window cannot exceed a maximum limit of 1825 days. If administrators set the idle lifetime to 30 minutes, Okta expires the refresh token if it remains unused for that duration.
