title: What is intent of ID Token expiry time in OpenID Connect?
body: <p>In OpenID Connect an <em>access token</em> has an expiry time.  For authorization code flow, this is typically short (eg 20 minutes) after which you use the refresh token to request a new access token.</p>
  <p>The <em>ID token</em> also has an expiry time.  My question is what is the intent of this?</p>
  <p>Any ID token expiry time less than the expiry time of the refresh token will mean you will eventually have an expired ID token, but a valid access token.</p>
  <p>So are you meant to:</p>
  <ul>
  <li>give your ID token an expiry longer than the refresh token expiry, or</li>
  <li>set it to the same expiry as the access token and take some action (what?) when it expires, or</li>
  <li>just consume the ID token in your client on receipt, then ignore the expiry time after that?</li>
  </ul>
  <p>The <a href="http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation" rel="noreferrer">OpenID Connect specification</a> just says that when validating an ID token,</p>
  <pre><code>&quot;The current time MUST be before the time represented by the exp Claim.&quot;
  </code></pre>
  <p>which (possibly) supports the third option above.</p>
  <hr />
  <p><strong>EDIT</strong></p>
  <p>As OpenID Connect builds on OAuth2 the answer to the supplementary question below can be found in the <a href="https://www.rfc-editor.org/rfc/rfc6749#section-5.1" rel="noreferrer">OAuth2 specification</a> which says,</p>
  <pre><code>expires_in
       RECOMMENDED.  The lifetime in seconds of the access token.
  </code></pre>
  <hr />
  <p>A related question is when you exchange an authorization code for the tokens, the same specification says you might get a response such as:</p>
  <pre><code>{
   &quot;access_token&quot;: &quot;SlAV32hkKG&quot;,
   &quot;token_type&quot;: &quot;Bearer&quot;,
   &quot;refresh_token&quot;: &quot;8xLOxBtZp8&quot;,
   &quot;expires_in&quot;: 3600,
   &quot;id_token&quot;: &quot;eyJhbG[...]&quot;
  }
  </code></pre>
  <p>But what does &quot;expires_in&quot; relate to in this case?  The access token, the refresh token or the ID token?</p>
  <p>(For information, <a href="https://github.com/thinktecture/Thinktecture.IdentityServer.v3" rel="noreferrer">IdentityServer3</a> sets this to the access token expiry time).</p>