76

We have a standalone Java application (see "Installed application") which runs periodically and uses Google API (updates some information from customer databases/ldap/...).

To access Google APIs we store username and password in configuration file, which is a security risk and customer does not like that. So we would like to use OAuth2 long-living access token instead.

What`s default expiration time for Google OAuth2 access tokens ?

As we will have only access token in application, app itself cannot refresh it when access token expires.

Personally I think that OAuth2 implementation in this case will not bring any major benefit but let`s focus on main question - default expiration times.

informatik01
  • 16,038
  • 10
  • 74
  • 104
Martin V.
  • 3,560
  • 6
  • 31
  • 47

2 Answers2

135

You shouldn't design your application based on specific lifetimes of access tokens. Just assume they are (very) short lived.

However, after a successful completion of the OAuth2 installed application flow, you will get back a refresh token. This refresh token never expires, and you can use it to exchange it for an access token as needed. Save the refresh tokens, and use them to get access tokens on-demand (which should then immediately be used to get access to user data).

EDIT: My comments above notwithstanding, there are two easy ways to get the access token expiration time:

  1. It is a parameter in the response (expires_in)when you exchange your refresh token (using /o/oauth2/token endpoint). More details.

  2. There is also an API that returns the remaining lifetime of the access_token:

    https://www.googleapis.com/oauth2/v1/tokeninfo?access_token={accessToken}

    This will return a json array that will contain an expires_in parameter, which is the number of seconds left in the lifetime of the token.

vlatko
  • 3,234
  • 1
  • 18
  • 11
  • SO i need client secret only for first autorization and then later after i will get access and refresh token app can have access – Martin V. Dec 13 '12 at 02:56
  • 3
    @martin85 Well, there are multiple steps involved. First obtain the authorization code, then exchange the authorization code for a refresh token (here's where you would use the client secret). Once you have the refresh token, you can exchange it for an access token. The web UI will be shown to the user only when you are obtaining the refresh token (you have to get user's approval to access their data). After that the flow does not need to involve the user. – vlatko Dec 13 '12 at 05:36
  • Is it possible to make autorization and approval step purely programatically ? I am not running any webapp - it`s more batch/long running daemon app. – Martin V. Dec 13 '12 at 20:02
  • 1
    @martin85 yes, you could bypass the user UI with the OAuth2 [Service Accounts](https://developers.google.com/accounts/docs/OAuth2ServiceAccount) flow, assuming your application has access to the API. See [this](http://stackoverflow.com/questions/13748837/google-analytics-3-0-auth-flow/13834210#13834210) question for an example w/ the Google Analytics API. – vlatko Dec 14 '12 at 02:08
  • vlatko, you don't necessary get a refresh token upon successful authorization. Look here, at my post (http://stackoverflow.com/questions/27678496/google-oauth-access-token-expiration-in-mvc-app), Google OAuth2 service doesn't issue a refresh token, at least this is what I see debugging the application. – monstro Dec 28 '14 at 22:34
  • 11
    You have to set accessType to 'offline' to obtain a refresh token – Alex Jan 15 '15 at 12:16
  • What do you do with OAuth mobile flow? You don't have a refresh_token in mobile apps auth, because you can't have a secret code (anybody could decompile the app and see it). What happens when the token gets expired? – sasha.sochka Jan 14 '16 at 01:10
  • @vlatko what does very short lived mean? – Internial Oct 16 '17 at 21:10
  • 7
    @Internial Right now, Google access tokens have a TTL of 1 hour. – z80crew Jul 23 '18 at 09:13
  • Hey all, question on this one. When we exchange a refresh token does the user need to login again with gmail? – giaggi Jul 29 '21 at 11:51
11

The default expiry_date for google oauth2 access token is 1 hour. The expiry_date is in the Unix epoch time in milliseconds. If you want to read this in human readable format then you can simply check it here..Unix timestamp to human readable time

Rajkumar Bansal
  • 323
  • 2
  • 10