How long should my tokens live?

As short as your refresh logic comfortably handles. 300 seconds (5 minutes) is a reasonable default. The widget refresh path is automatic via onAuthExpired, so short tokens add no UX friction.

Was this article helpful?