OAuth2 and Google API: Access token expiration time?

Question

We have a standalone Java application (see 'Installed application': https://developers.google.com/accounts/docs/OAuth2) which runs periodically and uses google API (updates some informations from customer databases/ldap/...).

To access Google APIs we store username and password in configuration file, which is a security risk and customer does not like that. So we would like to use OAuth2 long-living access token instead.

what`s default expiration time for Google OAuth2 access tokens ?

As we will have only access token in application, app itself cannot refresh it when access token expires...

Personally i think that OAuth2 implementation in this case will not bring any major benefit but let`s focus on main question - default expiration times.

Answer 1

You shouldn't design your application based on specific lifetimes of access tokens. Just assume they are (very) short lived.

However, after a successful completion of the OAuth2 installed application flow, you will get back a refresh token. This refresh token never expires, and you can use it to exchange it for an access token as needed. Save the refresh tokens, and use them to get access tokens on-demand (which should then immediately be used to get access to user data).

EDIT: My comments above notwithstanding, there are two easy ways to get the access token expiration time:

1. It is a parameter in the response (expires_in)when you exchange your refresh token (using /o/oauth2/token endpoint). More details.

2. There is also an API that returns the remaining lifetime of the access_token:

   https://www.googleapis.com/oauth2/v1/tokeninfo?access_token={accessToken}

   This will return a json array that will contain an expires_in parameter, which is the number of seconds left in the lifetime of the token.

Answer 2

The default expiry_date for google oauth2 access token is 1 hour. The expiry_date is in the Unix epoch time in milliseconds. If you want to read this in human readable format then you can simply check it here..Unix timestamp to human readable time

Answer 3

Here is one further observation to the Google access token expiry question. I have a server that makes use of Google Oauth2, and it uses the endpoint https://www.googleapis.com/oauth2/v3/userinfo?access_token=YOUR_ACCESS_TOKEN to do a first level of authentication. What I've found is that used in this way, the access token has a much longer duration of life than 60 minutes. I'm not certain it does expire when only used in this way.

Has anyone seen documentation of expiry duration of access tokens used only in this way?