2

I'm using Ory Hydra as OAuth2 server. There's a config to set custom expiration time, but it's static and used for all tokens that I create. https://www.ory.sh/docs/hydra/guides/token-expiration#access-token-expiration

I want to have the ability to set the token's expiration time when I create a token for the client (expiration time per token) or at least when I create the client (so I'll be able to use different expiration time for different clients). Is it possible?

miroshnik
  • 163
  • 1
  • 8

2 Answers2

0

Can you share a bit more on your use case? AFAIK it is not possible to configure the lifetime of tokens per client at the moment. But in most cases I can think of this would not be necessary from a security standpoint, so I am would like to learn more why you are looking to configure the lifetimes individually.

If you have a refresh token the lifetime of an access token is negligible (in most cases) and best to keep reasonably short! In the scenario of web/native apps this definitely applies and you will have more complexity if you have different lifetimes as you will have when just following the refresh token flow.

vinckr
  • 150
  • 8
  • We were reworking our IAM service to use Ory under the hood instead of our custom implementation. And that feature was in our old implementation. And this feature was required in the new service to support backward compatibility. That's it. – miroshnik Feb 04 '23 at 17:01
0

It is now possible to set individual expiration times per OAuth client.

https://www.ory.sh/docs/hydra/guides/client-token-expiration#lifespan-configuration-for-specific-clients

Cameron Little
  • 3,487
  • 23
  • 35