Setting Refresh token expiry time as per Client's request

[#1]

Is there a way to set refresh token expiry time in the Oauth policy based on the value given by the client ? (Ideally in query param or header). Following line of code fails schema validation in APIGEE.

<RefreshTokenExpiresIn>request.header.X-FE-RefreshExpiry</RefreshTokenExpiresIn>

Error in Apigeee: Error occurred while validation of bean GenerateAccessToken.xml. Reason: - Schema validation failed. Cause : For input string: 'request.header.X-FE-RefreshExpiry'. Line number : 7. Column number : 85. File name : GenerateAccessToken.xml.

Attached is the screen shot showing it in detail.

If the above-mentioned method is not possible, then what are my options on configuring different Refresh Token expiry time for different clients ? For Example : for Mobile client, I want expiry time to be 60 days. But for web, I want it 30 mins.

[hadleena · Accepted solution]

Hi @nishah,

Can you try using the below code and check once:

<RefreshTokenExpiresIn ref="request.header.X-FE-RefreshExpiry">3600000</RefreshTokenExpiresIn>

You would also have to give a default value to avoid schema validation error. The referenced variable takes precedence anyway.

Hope this helps!