github - Github OAuth API 访问 token 的生命周期是多少

Question

github oauth 访问 token 的到期时间是多少。还有我该如何续订。我在他们的文档中没有看到任何刷新 token 。请指导我。提前致谢。

Answer 1

2014:正如“GitHub OAuth Busy Developer's Guide”中评论的那样

Tokens don't have to expire.
They only send back the access token and an expiration (field "expires_in", seen as far back as 2013) if the offline_access scope is not requested (as it is the case for a refresh token).
Right now, GitHub just assumes all apps want offline access.

您可以查看OAuth application authorization ，删除或撤销。
但 token 本身似乎并没有绑定(bind)到期日期unless they are not use for one year 。

badsyntax添加in the comments :

I also found this useful:

"An OAuth token does not expire until the person who authorized the OAuth App revokes the token."
From "Migrating OAuth Apps to GitHub Apps".

Stokito指出in the comments至 rfc6749 / 4.2.2 Access Token Response :

expires_in

RECOMMENDED.
The lifetime in seconds of the access token.
For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated.
If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value.