SyntaxFix

[security] OAuth2 and Google API: access token expiration time?

You shouldn't design your application based on specific lifetimes of access tokens. Just assume they are (very) short lived.

However, after a successful completion of the OAuth2 installed application flow, you will get back a refresh token. This refresh token never expires, and you can use it to exchange it for an access token as needed. Save the refresh tokens, and use them to get access tokens on-demand (which should then immediately be used to get access to user data).

EDIT: My comments above notwithstanding, there are two easy ways to get the access token expiration time:

  1. It is a parameter in the response (expires_in)when you exchange your refresh token (using /o/oauth2/token endpoint). More details.

  2. There is also an API that returns the remaining lifetime of the access_token:

    https://www.googleapis.com/oauth2/v1/tokeninfo?access_token={accessToken}

    This will return a json array that will contain an expires_in parameter, which is the number of seconds left in the lifetime of the token.

Examples related to security

• Monitoring the Full Disclosure mailinglist • Two Page Login with Spring Security 3.2.x • How to prevent a browser from storing passwords • JWT authentication for ASP.NET Web API • How to use a client certificate to authenticate and authorize in a Web API • Disable-web-security in Chrome 48+ • When you use 'badidea' or 'thisisunsafe' to bypass a Chrome certificate/HSTS error, does it only apply for the current site? • How does Content Security Policy (CSP) work? • How to prevent Screen Capture in Android • Default SecurityProtocol in .NET 4.5

Examples related to google-api

• Google API authentication: Not valid origin for the client • Using Postman to access OAuth 2.0 Google APIs • How can I validate google reCAPTCHA v2 using javascript/jQuery? • This IP, site or mobile application is not authorized to use this API key • Is there a Google Keep API? • OAuth2 and Google API: access token expiration time? • invalid_grant trying to get oAuth token from google • Alternative to google finance api • How do I access (read, write) Google Sheets spreadsheets with Python? • How to refresh token with Google API client?

Examples related to oauth-2.0

• Using Axios GET with Authorization Header in React-Native App • What are the main differences between JWT and OAuth authentication? • How do I get an OAuth 2.0 authentication token in C# • Using Postman to access OAuth 2.0 Google APIs • Correct way to set Bearer token with CURL • Using an authorization header with Fetch in React Native • Getting "error": "unsupported_grant_type" when trying to get a JWT by calling an OWIN OAuth secured Web Api via Postman • JWT (Json Web Token) Audience "aud" versus Client_Id - What's the difference? • JWT refresh token flow • Spring-Security-Oauth2: Full authentication is required to access this resource

Examples related to google-api-java-client

• OAuth2 and Google API: access token expiration time?

Examples related to google-oauth

• Google API authentication: Not valid origin for the client • Using Postman to access OAuth 2.0 Google APIs • Google OAUTH: The redirect URI in the request did not match a registered redirect URI • Refused to display in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN' • invalid_client in google oauth2 • OAuth2 and Google API: access token expiration time? • Where can I get Google developer key • Why do access tokens expire? • Google Authenticator available as a public service? • How can I verify a Google authentication API access token?