How will session expire time and refresh token lifetime work together?

The two lifetimes operate relatively independently of one another: your refresh token expiring will NOT affect your Okta session expiring and vice versa. If the Okta session is set to expire after the user’s session in the browser is idle for 2 hours, their Okta session/session cookie will expire and they will not be able to access the Okta dashboard, but as long as they have valid tokens (access, refresh), they can still access an OIDC application they are already logged into.

I put some more details about the two different lifetimes and how they factor into our SDKs in this thread, which talks about how the Okta session can be used to renew tokens for users in SPAs when refresh tokens aren’t available.

4 Likes