Skip to content

docs: authentication session TTL #2224

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

docs: authentication session TTL #2224

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
224874d
docs: authentication session TTL
aeneasr Jun 23, 2025
a207e66
chore: format
vinckr Jun 23, 2025
28f41ef
chore: link
vinckr Jun 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 20 additions & 2 deletions docs/hydra/guides/client-token-expiration.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
id: client-token-expiration
title: Configure token expiration time
sidebar_label: Configure token expiration
title: Configure OAuth2 & OpenID Connect expiration times
sidebar_label: Configure expiration
---

This document describes how to configure the token expiration time for various tokens in Ory, including the user login and consent
Expand Down Expand Up @@ -74,6 +74,24 @@ ory patch oauth2-config --project <project-id> --workspace <workspace-id> \
--format yaml
```

### Authentication session

The authentication session in Ory defines how long the user remains authenticated after logging in. By default, the authentication
session lasts for 30 days and the maximum time is 180 days. You can modify this value using the Ory CLI:

```shell
ory patch oauth2-config --project <project-id> --workspace <workspace-id> \
--replace "/ttl/authentication_session=\"30d\"" \
--format yaml
```

The authentication session has no impact on any existing access, refresh, or ID tokens. If it is expired, the user will have to
perform the "login flow" again when performing the [OAuth2 Authorization Code Flow](../../oauth2-oidc/authorization-code-flow) or
OpenID Connect Implicit / Hybrid Flow.

Furthermore, [OpenID Connect Back-Channel Logout](../../oauth2-oidc/oidc-logout) won't work if the authentication session is
expired.

## Lifespan configuration for specific clients

In Ory, you can modify the access, ID, and refresh token lifespan for each grant type (`authorization_code`, `implicit`,
Expand Down
Loading