<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Mischa,<div class=""><br class=""></div><div class="">I don’t believe it’s a formal standard but there is a fair bit of support from OP’s for refresh_token_expires_in so it has become the defacto standard for what you’re mentioning below.</div><div class=""><br class=""></div><div class="">From some Linkedin documentation (<a href="https://developer.linkedin.com/docs/Refresh-Tokens-with-OAuth-2#" class="">https://developer.linkedin.com/docs/Refresh-Tokens-with-OAuth-2#</a>):</div><div class=""><br class=""></div><div class="">refresh_token_expires_in — The number of seconds remaining before the refresh token will expire. The lifespan of refresh tokens is usually larger than Access tokens. The exact duration depends on the type of Refresh Tokens issued. The different types explained below in the document.</div><div class=""><br class=""></div><div class="">Hope that helps,</div><div class=""><br class=""></div><div class="">Stuart</div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 27 Aug 2019, at 10:22 pm, Mischa Salle via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi all,<br class=""><br class="">I was wondering if there is any standard (RFC or OpenID) for conveying<br class="">the lifetime or expiry time of a refresh token?<br class="">The access token response returns an expires_in for the<br class="">access token, following <a href="https://tools.ietf.org/html/rfc6749#section-4.2.2" class="">https://tools.ietf.org/html/rfc6749#section-4.2.2</a><br class="">but there seems to be no standard for returning an expiry time or<br class="">lifetime for the refresh token.<br class="">It would certainly be useful information for a client.<br class=""><br class="">In case there is no standard yet, what would be the right thing to do?<br class="">I would suggest adding another access token response parameter, such as<br class="">rt_expires_in. Alternatively, it could be the expiry time, e.g.<br class="">refresh_token_exp or something like that.<br class=""><br class="">Are there already parties doing something like this?<br class=""><br class="">Mischa<br class=""><br class="">-- <br class="">Nikhef Room H155<br class="">Science Park 105 Tel. +31-20-592 5102<br class="">1098 XG Amsterdam Fax +31-20-592 5155<br class="">The Netherlands <a href="mailto:msalle@nikhef.nl" class="">Email msalle@nikhef.nl</a><br class=""> __ .. ... _._. .... ._ ... ._ ._.. ._.. .._..<br class="">_______________________________________________<br class="">Openid-specs-ab mailing list<br class=""><a href="mailto:Openid-specs-ab@lists.openid.net" class="">Openid-specs-ab@lists.openid.net</a><br class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab<br class=""></div></div></blockquote></div><br class=""></div></body></html>