For how long does an OAuth 2.0 token remain valid before requiring refresh?

• A. 10 minutes
• B. 12 minutes
• C. 15 minutes
• D. 20 minutes

Answer: (A)

In the context of OAuth 2.0, the validity period of access tokens can vary depending on the implementation and the service provider. However, a common practice in many implementations is to set the access token expiration to around 10 minutes. This relatively short lifespan is intended to enhance security by limiting the time window in which a stolen token could be misused. After the access token expires, a client application must use a refresh token to obtain a new access token, allowing users to stay authenticated without requiring them to log in again.

While tokens can have different lifespans based on security policies or specific configurations, 10 minutes is widely recognized as a standard duration in numerous applications and frameworks adhering to OAuth 2.0. This timeframe strikes a balance between usability and security, as it reduces the potential impact of token leaks while still providing a seamless user experience.