Recommended Configurations

The following configurations in the ‘access.config.yml’ will apply the configuration changes required for the API.

If expiry is forced but expires_in was not provided in the request, the default expiry shall be set for users.
An admin can restrict user identity tokens refresh-ability (i.e., disallow creating as refreshable)

default-expiry

The default expiry period in seconds, this is the token expiry when the expiry is set to null.
When set to zero, default expiry is not forced.
Must be non-negative.
Must comply with ('max-expiry' >= 'default-expiry').
Default value: 1 year

max-expiry

The maximum expiry value for access tokens created by non-admin users sets the maximum allowable duration for these tokens.
It is recommended to set a max-expiry value: when it is not set or set to zero, Admins can set the token to be non-expirable, and users can set the expires_in parameter to any value.
When set to more than zero, non-expirable tokens are forbidden for users, and the user's token expiry will be limited to the max-expiry value.
Must be non-negative.
Must comply with ('max-expiry' >= 'default-expiry').
Default value: 0

allow-refreshable

‘access.config.yml’ Example:

token:
  default-expiry: 31536000
  max-expiry: 0
  allow-refreshable: true