diff --git a/en/docs/consume/manage-application/generate-keys/obtain-access-token/changing-the-default-token-expiration-time.md b/en/docs/consume/manage-application/generate-keys/obtain-access-token/changing-the-default-token-expiration-time.md index 0c257b32c1..422388dcf6 100644 --- a/en/docs/consume/manage-application/generate-keys/obtain-access-token/changing-the-default-token-expiration-time.md +++ b/en/docs/consume/manage-application/generate-keys/obtain-access-token/changing-the-default-token-expiration-time.md @@ -5,7 +5,7 @@ Follow the instructions below to change the default token expiry time based on y ## Changing the default token expiration time at the global-level !!! note - The changes that you do here will be applied only to the new applications that you create. + The changes that you do here will be applied only to the new applications that you create. The token validity times must be defined in seconds. ### Changing the default expiration time of the application access tokens diff --git a/en/docs/design/api-security/oauth2/token-expiration.md b/en/docs/design/api-security/oauth2/token-expiration.md index 1031731544..6978f9ad96 100644 --- a/en/docs/design/api-security/oauth2/token-expiration.md +++ b/en/docs/design/api-security/oauth2/token-expiration.md @@ -2,17 +2,20 @@ ### Configuring the token expiration time -Application access tokens have a fixed expiration time, which is set to 60 minutes by default. Before deploying the API Manager to users, change the default expiration time by adding the following configuration to `/repository/conf/deployment.toml` file. +Application access tokens have a fixed expiration time, which is set to 60 minutes by default. Before deploying the API Manager to users, change the default expiration time by adding the following configuration to `/repository/conf/deployment.toml` file. The expiration time must be defined in seconds. ```toml [oauth] token_validation.app_access_token_validity = 10000 ``` -For more information about changing the default token expiration time, see [Changing the Default Token Expiration Time](../../../consume/manage-application/generate-keys/obtain-access-token/changing-the-default-token-expiration-time/). +!!! note + When the above configuration is updated, the changes will be applied only to the new applications that you create. + +For more information about changing the default token expiration time, see [Changing the Default Token Expiration Time]({{base_path}}/consume/manage-application/generate-keys/obtain-access-token/changing-the-default-token-expiration-time/). Also take the **time stamp skew** into account when configuring the expiration time. The time stamp skew is used to manage small time gaps in the system clocks of different servers. For example, let's say you have two Key Managers and you generate a token from the first one and authenticate with the other. If the second server's clock runs 300 seconds ahead, you can configure a 300s time stamp skew in the first server. When the first Key Manager generates a token (e.g., with the default life span, which is 3600 seconds), the time stamp skew is deducted from the token's life span. The new life span is 3300 seconds and the first server calls the second server after 3200 seconds. -You configure the time stamp skew using the by adding the following configuration in `/repository/conf/deployment.toml` file. +You configure the time stamp skew (in seconds) by adding the following configuration in `/repository/conf/deployment.toml` file. ```toml [oauth] timestamp_skew = 100