OAuth v2 (Google API) expiry Access Token

前端 未结 2 930
梦毁少年i
梦毁少年i 2020-12-30 09:23

I am building an integration component using a graphical framework who has a pre-build OAuth2 connector. This framework required following fields for OAuth v2:

相关标签:
2条回答
  • 2020-12-30 10:02

    You can use Refresh tokens to make it more long used. The Google Auth server issued Refresh tokens never expire, A token might stop working for one of these reasons: The user has revoked access. The token has not been used for six months. The user changed passwords and the token contains Gmail scopes. The user account has exceeded a certain number of token requests. There is currently a limit of 50 refresh tokens per user account per client.If the limit is reached, creating a new token automatically invalidates the oldest token without warning. This limit does not apply to service accounts.

    from: https://developers.google.com/identity/protocols/OAuth2

    0 讨论(0)
  • 2020-12-30 10:21

    Access tokens typically expire after 60 minutes. If you have a refresh token you can use the refresh token to get a new (valid) access token.

    This doc explains how to do that:
    https://developers.google.com/accounts/docs/OAuth2WebServer#refresh

    To answer your overarching question, yes, you are approaching everything correctly. All you need to do is handle the case where the access token has expired by refreshing it. Also, when you originally requested the access token the response should tell you how long it's valid for, so you should only refresh that token if it's expired.

    0 讨论(0)
提交回复
热议问题