Hi Paul, thanks for sharing that. The original poster's question is exactly what we're trying to accomplish, but none of the responses actually answered his question. Even his own response is a little ambiguous. I'm hoping you can clarify Okta's intended way for these tokens to be used.

To reiterate, what we're trying to do is display a countdown modal to the user letting them know how much time is left in their session. We currently have the access token set to expire ~5 minutes and 30 seconds before the id token. When the access token expires, we use an event handler for the expire event to display the countdown modal (which should display the time remaining in the id token). The user can then either choose to logout or renew the access token and continue with their session. Can you confirm if this is in line with Okta's recommendations?

That aside though, there are still 2 big discrepancies between the settings in our dashboard and the behavior we're seeing. I've already confirmed that the user/group being tested are all correct.

1. The refresh token is set to be unlimited, but in the authManager it has the same expiration time as the access token. The access token/id token expirations reflect our settings in the dashboard.
2. With the refresh token and access token expiration times being the same, I would expect that after the access token expires, any renew call would fail. However, there's a roughly 15-20 second window after the access token's expiration in which we are able to successfully renew.

Any light you can shed on these issues would be greatly appreciated.