Skip to content
ENExplore Calculators

OAuth Token Lifetime Calculator

Balance OAuth access and refresh token lifetimes against token endpoint load and the revocation delay they create.

About OAuth Token Lifetime Calculator

Access token lifetime sets both the refresh rate and the revocation delay, and the two pull in opposite directions. Halving the lifetime doubles token endpoint traffic but halves how long a stolen or revoked token keeps working, since resource servers that only validate signatures cannot know a token was withdrawn. This one number decides how long a compromised session survives after you disable the account, and teams routinely discover during an incident that a 24-hour access token means a 24-hour eviction delay.

Formulas

OAuth Token Lifetime

refreshes per user per day = ceil(active session minutes ÷ access token lifetime) − 1, and token endpoint load = refreshes × daily active users.

access token lifetime
How long a bearer token is accepted by resource servers
refresh token lifetime
How long a client may keep minting new access tokens

Revocation delay

revocation delay = access token lifetime, because a bearer token stays valid until it expires unless the resource server introspects every call.

introspection
Per-call token status check that trades latency for immediate revocation

Worked example

With the default values below, OAuth Token Lifetime Calculator returns Token Refreshes per User per Day of 7. Change any input above and every figure here is recalculated in your browser.

Inputs used

Access token lifetimeaccepts 1–1,440 minutes
60 minutes
Refresh token lifetimeaccepts 0.04–365 days
90 days
Daily active usersaccepts 1–50,000,000 users
20,000 users
Active session hours per user per dayaccepts 0.25–24 hours
8 hours
API calls per user per houraccepts 1–100,000 calls
40 calls

Results

Token Refreshes per User per Day
7
Token Endpoint Requests per Day
140,000
Average Token Endpoint Rate
1.620 req/s
Revocation Delay
1h
API Calls Served per Access Token
40
Token Exposure Score
48 / 100
Exposure Level
Medium

Step by step

  1. 1Values used
  2. 2OAuth Token Lifetime
  3. 3Revocation delay
  4. 4Token Refreshes per User per Day= 7
  5. 5Token Endpoint Requests per Day= 140,000
  6. 6Average Token Endpoint Rate= 1.620 req/s
  7. 7Revocation Delay= 60
  8. 8API Calls Served per Access Token= 40
  9. 9Token Exposure Score= 48 / 100

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is OAuth Token Lifetime calculated?

refreshes per user per day = ceil(active session minutes ÷ access token lifetime) − 1, and token endpoint load = refreshes × daily active users. Access token lifetime sets both the refresh rate and the revocation delay, and the two pull in opposite directions. Halving the lifetime doubles token endpoint traffic but halves how long a stolen or revoked token keeps working, since resource servers that only validate signatures cannot know a token was withdrawn.

Why does OAuth Token Lifetime matter?

This one number decides how long a compromised session survives after you disable the account, and teams routinely discover during an incident that a 24-hour access token means a 24-hour eviction delay.

What values do I need to enter?

This calculator takes 5 inputs: Access token lifetime, Refresh token lifetime, Daily active users, Active session hours per user per day, API calls per user per hour. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

What is a sensible access token lifetime?

Sixty minutes is the common default and is what Microsoft Entra ID issues (randomised between 60 and 90 minutes to avoid stampedes). Five to fifteen minutes is appropriate for high-value APIs, and anything beyond a few hours should be paired with token introspection so revocation is not deferred.

How can I revoke access faster without shortening the token?

Have resource servers call the introspection endpoint, or use short-lived tokens with a revocation-checked refresh, so the identity provider is consulted while the session continues. Continuous access evaluation, which pushes revocation events to resource servers, achieves the same result without per-call latency.

Related Calculators

OAuth Token Lifetime Calculator | Calcrivo