# Refresh token lifetime

**URL:** <https://devforum.okta.com/t/refresh-token-lifetime/5185>\
**Category:** OAuth/OIDC\
**Tags:** api\
**Created:** [May 23, 2019, 2:28am UTC](https://devforum.okta.com/t/refresh-token-lifetime/5185 "2019-05-23T02:28:56Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![KD84](https://avatars.discourse-cdn.com/v4/letter/k/9fc348/32.png) [@KD84](https://devforum.okta.com/u/KD84)\
**Post date:** [May 23, 2019, 2:28am UTC](https://devforum.okta.com/t/refresh-token-lifetime/5185/1 "2019-05-23T02:28:57Z")

</div>

Hi Team,

What is default timeout of OKTA refresh timeout?  
I have access\_token which expires after 1 hour and am using refresh\_token to renew the access\_token after 1 hour. Though just curious is there any expiry of refresh\_token.

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [May 23, 2019, 8:37am UTC](https://devforum.okta.com/t/refresh-token-lifetime/5185/2 "2019-05-23T08:37:14Z")

</div>

Hi @KD84

If you are using Okta authorization server (eg. authorization endpoint looks like /oauth2/v1/authorize), refresh token will have a fixed lifetime of 100 days.

If you are using a custom authorization server (eg. authorization endpoint looks like /oauth2/${authServer}/v1/authorize), then you can customize the lifetime to anytime between 10 minutes and potentially unlimited from the Access Policies inside the authorization server in Okta administrative panel.

---

<div class="post-metadata">

**Author:** ![Govner](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/govner/32/1099_2.png) [@Govner](https://devforum.okta.com/u/Govner)\
**Post date:** [May 23, 2019, 10:11am UTC](https://devforum.okta.com/t/refresh-token-lifetime/5185/3 "2019-05-23T10:11:37Z")

</div>

![image](https://global.discourse-cdn.com/oktadev/original/2X/3/3f60ee549d17ca40795029b1b98d1af3af0d27aa.png)

---

<div class="post-metadata">

**Author:** ![gcgc](https://avatars.discourse-cdn.com/v4/letter/g/c5a1d2/32.png) [@gcgc](https://devforum.okta.com/u/gcgc)\
**Post date:** [January 14, 2022, 8:12pm UTC](https://devforum.okta.com/t/refresh-token-lifetime/5185/4 "2022-01-14T20:12:55Z")

</div>

what is the default lifetime of refresh token for a custom authorization server if I don’t explicitly set it?

---

<div class="post-metadata">

**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\
**Post date:** [January 15, 2022, 10:59pm UTC](https://devforum.okta.com/t/refresh-token-lifetime/5185/5 "2022-01-15T22:59:09Z")

</div>

I believe it’s shown by default for authZ server policy as unlimited, but will expire if not used every 7 days

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [January 18, 2022, 7:25pm UTC](https://devforum.okta.com/t/refresh-token-lifetime/5185/6 "2022-01-18T19:25:58Z")

</div>

@phi1ipp is correct, those are the lifetimes set for the Default Authorization Server. All other custom authorization servers that you create will NOT have an Access Policy/Rule created for you, so there is no default and you must configure this policy/rule for each server explicitly.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 8, 2024, 9:17pm UTC](https://devforum.okta.com/t/refresh-token-lifetime/5185/7 "2024-02-08T21:17:53Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.