Auth0 OAuth 2.0 Authorization Code Expiry Time and One-Time Use Controls
Last Updated:
Overview
Auth0 enforces a 10-minute expiration time and strict one-time use for authorization codes returned during the OAuth 2.0 flow. Administrators require details regarding the specific security controls and lifecycle policies that Auth0 applies to these authorization codes.
Applies To
- Auth0
- OAuth 2.0
- Authorization Code Flow
Solution
What is the expiration time for an Auth0 authorization code?
Auth0 enforces a 10-minute Time-To-Live (TTL) for authorization codes. This aligns with the recommended expiration time described in the OAuth 2.0 RFC 6749 specification.
Does Auth0 enforce one-time use for authorization codes?
Auth0 strictly enforces one-time use for all authorization codes. Once an application exchanges an authorization code for a token, Auth0 invalidates the code to prevent reuse.
