What's the standard lifetime of refresh token incase of Resource Credentials Password Grant Type ?

[anilsr]

AccessToken lifetime should be few hours.

What about the RefreshToken TTL ? Should it be few hours / weeks / months ? What's the Apigee standard ?

[#2]

I guess the answer would be it depends on the customer's security profile and how often customer wants their login/password running on the wire. It could be along the same lines as accesstoken TTL. Not sure if this can be made as an standard practice.

The refresh token TTL can also have a number (number of times, it can be used to generate a accesstoken) instead of TTL, although i have not personally tried this.

[anilsr]

@pdani , That's correct. Do we have any examples of RefreshToken TTL ? What's our recommended approach ? Any examples of our customers (without names) internal apps ?

[#4]

Here is what I found in the community for setting expiration on refresh token

https://community.apigee.com/questions/1991/how-to-i-generate-different-expiry-time-for-refres.html