Access Token Settings & Session Expiration

Token Expiration Settings

cache.accessTokenExpireDuration

This parameter defines the expiration time (in seconds) for the access token. After this duration, users must log in again. The default value is 28,800 seconds (8 hours).

• The session expiration warning (notifyBeforeExpiration) and automatic refresh (refreshBeforeExpiration) depend on this setting.

cache.refreshTokenExpireDuration

This parameter is usually not relevant in practice, as a new refresh token is generated with each login. The default is 30 days, meaning users who log in at least once a month will not experience refresh token expiration.

Session Expiration Warnings & Auto-Renewal

tas.sessionExpiration.notifyBeforeExpiration

This setting controls how long before session expiration a warning message appears. The recommended value is 15 minutes (900 seconds).

• Users receive a notification 15 minutes before expiration.
• Clicking "Continue Working" extends the session by the value of cache.accessTokenExpireDuration.
• If the user does not respond in time, they will be logged out and must log in again.

tas.sessionExpiration.refreshBeforeExpiration

This setting defines when the access token is automatically refreshed if the user is active in TAS.

• The refresh happens when a user performs an action that interacts with the backend.
• The default value is -1, meaning auto-refresh is disabled.
• If enabled, active users never see session expiration warnings.
• If inactive (e.g., away for lunch), users will receive a warning or be logged out.

This setting helps balance security and usability. Organizations can adjust it to enforce stricter or more flexible session policies.

Safe Testing Durations