# Diagnose: token/session lifetime confusion

## Symptom

Users complain about frequent logouts, or security review flags tokens living too long.

## The four lifetimes

1. Access token lifetime: API settings (default 24h for custom APIs, shorter for Management API). `exp` in the token.
2. ID token lifetime: application settings.
3. Refresh token -  absolute lifetime (hard cap from first issuance) and inactivity lifetime (idle expiry). Application > Refresh Token settings.
4. SSO session: tenant session layers (idle timeout, absolute timeout) under Dashboard > Settings > Advanced or Session Management.

## Confirm

Decode the access token -  `exp - iat` = the access token lifetime in force. Compare with the API setting. For sessions, check the tenant session settings and the application's refresh token settings side by side; the SHORTEST applicable lifetime wins the user's experience.

Tenant logs show token issuance; the absence of refresh events after the inactivity window confirms idle expiry is the limiter.

## Fix

- Frequent logouts with a good refresh setup: the inactivity lifetime is too short, or the app is not using the refresh token (relying on the access token alone).
- Too-long sessions: tighten absolute lifetime first (the backstop), then inactivity.
- Never "fix" short sessions by minting 30-day access tokens. Use refresh rotation; access tokens stay short.

## Verify

Set a test user, wait out (or simulate) each boundary, and confirm the behavior matches the intended layer. Document the four numbers in the runbook.