OAuth Token Lifetime Calculator

refreshes per user per day = ceil(active session minutes ÷ access token lifetime) − 1, and token endpoint load = refreshes × daily active users. Access token lifetime sets both the refresh rate and the revocation delay, and the two pull in opposite directions. Halving the lifetime doubles token endpoint traffic but halves how long a stolen or revoked token keeps working, since resource servers that only validate signatures cannot know a token was withdrawn.

This one number decides how long a compromised session survives after you disable the account, and teams routinely discover during an incident that a 24-hour access token means a 24-hour eviction delay.

This calculator takes 5 inputs: Access token lifetime, Refresh token lifetime, Daily active users, Active session hours per user per day, API calls per user per hour. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Sixty minutes is the common default and is what Microsoft Entra ID issues (randomised between 60 and 90 minutes to avoid stampedes). Five to fifteen minutes is appropriate for high-value APIs, and anything beyond a few hours should be paired with token introspection so revocation is not deferred.

Have resource servers call the introspection endpoint, or use short-lived tokens with a revocation-checked refresh, so the identity provider is consulted while the session continues. Continuous access evaluation, which pushes revocation events to resource servers, achieves the same result without per-call latency.