# Token lifetimes from an availability point of view?

**URL:** <https://devforum.okta.com/t/token-lifetimes-from-an-availability-point-of-view/19985>\
**Category:** Questions\
**Created:** [March 25, 2022, 10:29pm UTC](https://devforum.okta.com/t/token-lifetimes-from-an-availability-point-of-view/19985 "2022-03-25T22:29:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Timinator](https://avatars.discourse-cdn.com/v4/letter/t/45deac/32.png) [@Timinator](https://devforum.okta.com/u/Timinator)\
**Post date:** [March 25, 2022, 10:29pm UTC](https://devforum.okta.com/t/token-lifetimes-from-an-availability-point-of-view/19985/1 "2022-03-25T22:29:12Z")

</div>

I’ve seen lots of discussion about machine-to-machine token lifetimes, but it essentially boils down to: shorter lifetime = more secure but more cost (because more tokens), longer lifetime = less secure (which may be OK for less sensitive app data) but less cost (because fewer tokens).

However someone asked me: what if your main focus is on authentication availability. While Okta’s 99.99% SLA (and better actual performance) means we expect very little unavailability, is it as simple as saying that if availability is more important than security then make your M2M token lifetime, say, 2 hr (which is twice as long as the SLA outage time)?

Any other thoughts?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 12, 2024, 6:19pm UTC](https://devforum.okta.com/t/token-lifetimes-from-an-availability-point-of-view/19985/2 "2024-02-12T18:19:52Z")

</div>

Closed on February 12, 2024, 6:19pm UTC