Home/ Questions/Q 9012003
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-16T02:53:19+00:00

The oauth docs says Each access_token is valid for 1 hour and each refresh

  • 0

The oauth docs says
Each access_token is valid for 1 hour and each refresh token is valid for 14 days. To use the refresh_token to get a new access_token, make a POST request to https://api.box.com/oauth2/token

In this response, you’ll receive both a new access_token and refresh_token. The refresh_token you used to make this request is no longer valid.

Questions:
1) If by chance I am not able to store this new refresh_token then the old refresh_token is invalidated?

2) Can’t there be refresh token which is valid always and we generate only access_token?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    1. Yes, when a new refresh_token is created, the previous one is invalidated.

    2. Part of the OAuth 2 spec includes invalidating old refresh_tokens in exchange for a new one. It’s not the most gripping read, but you can see all of that here: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-31

    • 0