The following configurations in the ‘access.config.yml’ will apply the configuration changes required for the API.
Note
If expiry is forced but expires_in was not provided in the request, the default expiry shall be set for users.
An admin can restrict user identity tokens refresh-ability (i.e., disallow creating as refreshable)
default-expiry
The default expiry period in seconds, this is the token expiry when the expiry is set to null.
When set to zero, default expiry is not forced.
Must be non-negative.
Must comply with ('
max-expiry
' >= 'default-expiry
').Default value: 1 year
max-expiry
The maximum possible expiry of non-admin tokens.
It is recommended to set a max-expiry value: when it is not set or set to zero, Admins can set the token to be non-expirable, and users can set the
expires_in
parameter to any value.When set to more than zero, non-expirable tokens are forbidden for users, and the user's token expiry will be limited to the
max-expiry
value.Must be non-negative.
Must comply with ('
max-expiry
' >= 'default-expiry
').Default value: 0
allow-refreshable
When disabled, all the user tokens will be created as non-refreshable.
Default: true
‘access.config.yml’ Example:
token: default-expiry: 31536000 max-expiry: 0 allow-refreshable: true