OAuth 2 Authorization Code - how long is it valid?

Question

In Webserver Grant Flow After I obtain the Authorization Code from the authorization authority (after the user has authorized my access) how long is that code usually valid form? The reason i am asking is, can my webserver store that code and use it in later sessions to retrieve a new access token without the need for the user to re-authenticate again? Should that be the flow?

FYI my goal is make requests from Adobe Analytics and Google Analytics on behalf of my customer. So i would want to ask my customer for authorization once until he revokes my access.

Answer 1

Speaking strictly of Google Oauth. There are three types of codes or tokens you should be aware of.

1. Authorization code
2. Access token
3. Refresh token

Authorization code is return when the user clicks accept to your application accessing their data. This code is used to exchange for an access token and a refresh token. This code can only be used once and is extremely short lived 10 minutes I believe.

Access tokens are used to access private user data. They are valid for approximately one hour.

Refresh tokens are used to gain a new access token when the access token has expired. For the most part refresh tokens do not expire however if it has not been used for six months it will no longer be valid and of course the user can always remove your access.

Answer: No storing the authentication code would be pointless. You will need to store the refresh token. make sure you are requesting offline access of your users.

I cant help you with adobe analytics however I suspect it is similar this is standard Oauth protocol we are talking about.