Token Validity

Grant Token (Authorization code)

• Grant token is a one-time use token and valid for two minutes.

• You can generate a maximum of 10 grant tokens in a span of 10 minutes per client ID.

Access Token

• Each access token is valid for one hour.

• You can generate a maximum of 10 access tokens in a span of 10 minutes.

• When you generate the 11th access token, the first created access token will be deleted.

Refresh Token

• Refresh tokens do not expire until a user revokes them.

• You can generate a maximum of 10 access tokens from a refresh token in a span of 10 minutes.

• You can generate a maximum of 20 refresh tokens in a span of 10 minutes per client ID.

• When you generate the 21st refresh token, the first created refresh token gets deleted.

• When you generate an access token using a revoked refresh token, the system returns the "invalid_code" error.

• When you revoke a refresh token, all the access tokens you generated with that refresh token also become invalid. When you use any of these access tokens in an API call, the system returns the "invalid_token" error.