Issue: Refresh token expires along with Access Token thus preventing from getting a new Access Token

Question

Hello Team,

Please review:

1. The Refresh token expiry is given as 90 days in the documentation but if I try to get a new access token after an hour it fails. Is the expiry time correct?

2. Is there a way to increase the expiry period of a RT?

3. I am able to use the RT multiple time in the 1 hour period is this an expected behavior?

4. Is there a change in expiry period for old RTs after a new RT is generated?

5. In my current setup I have configured the OAuth in two places (one in a 3 rd party product and another in Postman) do you think this might have cause the issue?

Thank you all in advance for any help on guidance.

DPrince87 · Answer

Did you ever figure it out? I can't get an access token at all with jira cloud using the refresh token. I just get an unauthorized response:

curl --request POST --url 'https://auth.atlassian.com/oauth/token' --header 'Content-Type: application/json' --data '{ "grant_type": "refresh_token", "client_id": "VIda…", "client_secret": "h1Lq…", "refresh_token": "eyJr…" }'

{"error":"access_denied","error_description":"Unauthorized"}%

Murat Seven · Answer

Hi @Giri and welcome to the Community!

I might not be the best person to answer this question, but in my knowledge;

1- In Jira Cloud, Refresh tokens don’t expire so please make sure you store them very securely. And yes, the expiry time is correct. As said in the doc, 'refresh token that can then be used to generate a new access token'. So, the new token generated will expire in an hour!

2- There is no way to extend the life of an access token.

3- This is an expected behavior.

4- No, the expiry period for old RT remains the same.

5- I'm not sure about the source of the issue you're facing. However, using it in two different places shouldn't cause a problem.