How to use Token Expiration For Browser Flows (Seconds) field in API

An authorization flow issues an access token with a long expiration time (e.g., 432000 seconds) even when the Token Expiration For Browser Flows (Seconds) setting is configured for a shorter time (e.g., 300 seconds). This behavior is observed when the /authorize request uses parameters for the Authorization Code flow with Proof Key for Code Exchange (PKCE), such as:

response_type=code
code_challenge=<challenge_string>
code_challenge_method=S256

• APIs

• Authorization Flows

• Token Expiration

The Token Expiration For Browser Flows (Seconds) setting only applies to access tokens issued via implicit and hybrid flows. This setting does not cover all flows initiated from a browser. The Authorization Code flow with PKCE, even when initiated from a browser, uses the value from the main Token Expiration setting, not the Token Expiration For Browser Flows setting.

To have the shorter expiration time applied, use an authorization flow that respects the Token Expiration For Browser Flows (Seconds) setting. These flows include:

• Implicit flow: This flow typically uses a response_type such as token id_token.

• Hybrid flow

• Authorization Code flow: Use this flow without PKCE from a Single Page Application (SPA).