Search code examples
node.jsapiauthenticationjwtauth0

Check/ Decode auth0 Access Token


I need to know the time remaining in the Access Token and not the ID token or the token for browser flows. Checking the expiry of the token on http://www.jwt.io always returns 24 hours. However, the Access Token for the API should be longer than that. How can I check the expiring date?


Solution

  • If the authorization server provides an endpoint to get information about the token (the ideal would be to have an Introspection endpoint as per the RFC7662), then it is easy to have this information.

    Otherwise, if no endpoint is available, you have to keep in you memory the value in the expires_in parameter of your access token response (see RFC6749 section 4.1.4) and add the current timestamp to this value to get the exiration timestamp.

    Please note that the access tokens you receive may be revoked by the authorization server thus the token will be invalid before that expiration time.

    Another possibility if the access token is a signed Json Web Token (JWS - see RFC7515), you could parse the token and check the exp claim (optional, but usually present in such context).