Manage Auth0 Refresh Tokens and Sessions

Configure Auth0 to keep sessions alive for extended periods, even without user activity. Adjusting token and session lifetime settings in the Auth0 dashboard allows administrators to manage access token expiration, refresh token rotation, and tenant session limits.

• Auth0
• Refresh Tokens
• Session Management

How are token and session lifetimes configured in Auth0?

The Absolute Lifetime applies to the refresh token. If administrators disable this setting, the absolute lifetime remains indefinite. Review the Configure Refresh Token Expiration documentation for more details.

The default Access Token expiration is 24 hours, and the ID Token expiration is 10 hours. Review the resources for additional information on token lifetimes.

• Update Access Token Lifetime
• Update ID Token Lifetime

What are the API token settings?

Navigate to Dashboard > Applications > APIs > API Settings to configure token expiration. Review the access token expiration details.

• Token Expiration or Token Expiration For Browser Flows defines the expiry of the Access Token.
• Once this period elapses and the user performs any activity on the page, Auth0 triggers silent authentication and issues a new Access Token.
• Auth0 allows a maximum expiration value of 2592000 seconds (30 days) for issued access tokens.

How is refresh token rotation and expiration managed?

Navigate to Dashboard > Applications > Applications > Settings to configure refresh tokens. Applications use a Refresh Token to obtain a renewed access token. Configure the refresh token settings.

• Rotation: Enable this setting to return a new refresh token every time an application exchanges a refresh token for a new access token. This interval helps avoid concurrency issues when exchanging the rotating Refresh Token multiple times within a given timeframe. During the leeway window, the breach detection features do not apply, and Auth0 issues a new rotating Refresh Token. Only the previous token remains reusable; if the application exchanges the second-to-last token, Auth0 triggers breach detection.
• Absolute Lifetime and Inactivity Lifetime: These settings define the expiry of the Refresh Token used to get a new Access Token. Once this time elapses and the user performs any activity on the page, Auth0 issues a new Refresh Token and a new Access Token.

Where are tenant session limits configured?

Navigate to Dashboard > Settings > Advanced > Log In Session Management to configure the Inactivity timeout. The Tenant Session Management applies to the session represented by a cookie in the Auth0 tenant domain. Review the session lifetime limits.

• If the Auth0 session expires based on the tenant inactivity settings, the user must log back in.
• The Refresh Token does not allow for establishing a new Auth0 session.
• Auth0 forces the user to re-authenticate after 100 days of inactivity, after 365 days even with activity, or fewer days, depending on the tenant settings.
• Review the Session Lifetime Limits documentation for more details.