Django-oauth-toolkit: Access Tokens that don't expire

[jlhawn]

Is it currently possible to set it so that Access Tokens do not expire, and applications will no longer need the RefreshToken? Something like ACCESS_TOKEN_EXPIRE_SECONDS=None

I would like to make it so that tokens do not expire, but a resource owner can at any time choose to de-authorize an application (delete the access token). I believe this is how the Twitter API works as well: access tokens never expire, but are invalidated when a user explicitly rejects an application from their settings or the application is suspended by an admin.

[samuelclay]

You could just set it to a very high amount. From oauth2_validators.py:

expires = timezone.now() + timedelta(seconds=oauth2_settings.ACCESS_TOKEN_EXPIRE_SECONDS)

So just set ACCESS_TOKEN_EXPIRE_SECONDS in your oauth2_provider settings to a 10-year amount.

[davecap]

I would also like to be able to specify None for the AccessToken.expires, just because it's a cleaner way of storing a non-expiring token, and one less thing that clients have to keep track of. Expiring access tokens are in the OAuth2 specification, but they are only "recommended", not required... would it be possible to handle the case where AccessToken.expires = None?

[Psykopear]

We are closing this issue, as we agree with @samuelclay that expiring time can be set to a very high amount to solve this problem.