Token settings

Open a hosted authorization server and choose Settings, then Tokens. Configure access-token, refresh-token, authorization-code, and ID-token lifetimes together with token format and refresh rotation.

The console validates numeric ranges before saving, but the service remains authoritative. Saving sends the complete hosted configuration with expectedRevision; omitted values are not interpreted as a hidden compatibility fallback. A conflicting revision must be reviewed and resubmitted from the latest resource state.

Use short authorization-code lifetimes, rotate refresh tokens where supported, and align token lifetimes with the risk and assurance level of the clients using this authorization server. Changes apply to newly issued artifacts and do not rewrite already issued tokens.

The tab reads and replaces the aggregate hosted configuration below the selected UUID. Token settings are fields of that revisioned resource:

GET /api/platform/config/v1/tenants/{tenantId}/authorization-servers/{authorizationServerId}/configuration
PUT /api/platform/config/v1/tenants/{tenantId}/authorization-servers/{authorizationServerId}/configuration