Definition of "expires_in" Field in the "POST /oauth/token" Response in Auth0
Last Updated:
Overview
The expires_in field in the POST /oauth/token endpoint response represents the lifetime of the access token in seconds. The response from this endpoint includes an access token, an ID token, and a refresh token. This combination creates ambiguity regarding which token the expires_in field applies to.
Applies To
- Auth0
- Tokens
- Management API
POST /oauth/tokenEndpointexpires_inField
Solution
Which token lifetime does the expires_in field represent?
The OAuth 2.0 specification (RFC 6749) section 5.1 defines the token_type and expires_in fields present in the response of the POST /oauth/token endpoint. According to this specification, the expires_in field indicates the lifetime of the access token in seconds.
