I want to confirm the expiration time of the refresh token. Is there any way?

Question

I checked the document "https://learn.microsoft.com/en-us/graph/auth-v2-user?tabs=http#response-body-properties" and it seems that I can't get the refresh token expiration time, only can get the access token expiration time. Is there any way for me to find out the expiration time of the refresh token? I'm a bit concerned about whether it really gets automatically extended by 90 days and want to confirm this.

Answer 1

Hi @zhi qi

Thank you for reaching out to the community forum!

For your query, I understand that you would like to know the expiration time of the refresh token.

Different servers and clients may have different mechanisms for handling refresh tokens.

Unfortunately, there is no option to find the expiration time for the refresh token, because it is depending on authorization server and the type of client application, and it is not communicated to the client.

In the Microsoft identity platform, the default lifetime for refresh tokens is 90 days. Each time a refresh token is used to obtain a new access token, it is replaced with a new refresh token. This process is known as refresh token rotation. It helps to ensure that your application always has a valid refresh token.

If a refresh token is not used for a period of 90 days, it will expire and cannot be used for obtaining new access tokens. In such cases, the user would need to authenticate again to get a new refresh token.

Hope this answer helps. Do let us know if you any further queries.

Additional readings:

Refresh tokens in the Microsoft identity platform.

Thanks,

Akhilesh.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.