Set Different Access Token Expiration Depending on Application Grant Type

This article explains whether it is possible to have different expiration periods for API tokens depending on the Application Grant type. For example, a Regular Web Application using the Authorization Code Flow and a Machine to Machine app using client credentials.

• API Tokens
• Application Grant Types

Currently, there are two separate values that can be set within the API configuration settings to adjust the access token lifetime (expiration time):

• Token Expiration (Seconds) - This is the default setting that will apply to all tokens issued in flows that are not captured by the below setting.
• Token Expiration For Browser Flows (Seconds) - This setting will adjust the access token lifetime for tokens issued for the API via implicit and hybrid flows 

Unfortunately, this means it is not possible to set a different expiration for authorization code and client credential flows, as these are both captured under the first expiration setting outlined above.

As a workaround, it is possible to configure two separate APIs in Auth0, one for the M2M application and one for the user-facing application. The API would need to be configured to accept both kinds of tokens (as they would have different audiences).