Hi @DylanJ.11480 (Customer)​ , Thank you for reaching out to the Okta Community! 

Okta session policies can enforce both idle timeout (inactivity-based expiration) and absolute session lifetime (maximum duration from authentication). When an absolute session lifetime of 2 hours is set on a Global Session Policy or Sign-On Policy, the session is automatically revoked after 2 hours have elapsed since initial authentication, regardless of whether the user is actively using the app. Once the session is revoked, the refresh token associated with that session is invalidated by the authorization server, causing the invalid_grant error.

Follow these steps to investigate and adjust your session policies:

1. Navigate to Security → Global Session Policy in your Okta Admin Console.
2. Review the "Maximum session lifetime" setting on your active Global Session Policy. If this is set to 2 hours (or 120 minutes), this is the source of the issue.
3. Setup a new Global Session Policy (and assign it to test user/groups to confirm before assigning it to all) that has an increased maximum session lifetime setting. If you do not require an absolute session limit, set this to "No time limit." If you need a longer absolute timeout, increase the value to match your business requirements (for example, 8 hours or 24 hours).
4. Save the policy changes.
5. Check any Sign-On Policies applied to your application. Navigate to Security → Authentication Policies, select the policy assigned to your app, and review the "Maximum session lifetime" setting on the rules. Adjust this value if it is also set to 2 hours.
6. Verify in the System Log that refresh token requests are no longer returning invalid_grant errors. Navigate to Reports → System Log and search for token exchange events to confirm the change has taken effect.

The distinction between idle timeout and absolute session lifetime is critical: idle timeout only expires the session if the user is inactive, while absolute session lifetime expires the session after a fixed duration regardless of activity. Your refresh token configuration (1-hour access token, unlimited refresh token with 90-day inactivity expiration) is separate from the session lifetime policy and will not prevent this behavior if the session itself is revoked.

If your implementation is in relation to a Custom Authorization Server, my advice would be to reach out to our Okta Developer colleagues via devforum.okta.com to take advantage of their expertise.

While we'll do our best to answer all of your questions here, this medium is more inclined towards Okta general questions around core products and features (non-custom/developer work)

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

Hope my answer helps! 

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added