Use Auth settings to control how long users stay signed in. The page sets two timeouts for the owner company: how long each access token lasts, and how long a user can be idle before they must sign in again.
Fields
Both fields are required. Enter a whole number of minutes from 1 to 1440 (24 hours). The fields load with the company’s current values. If no value has been saved yet, each field defaults to 60.
Access token TTL (minutes)
How long each access token lasts before the app renews it in the background. The user stays signed in as long as that renewal succeeds. The value applies to every user of this company.
Example: 15 means the access token expires after 15 minutes, and the app requests a new one without asking the user to sign in.
Idle refresh TTL (minutes)
How long a user can go without activity before they must sign in again. Each successful token renewal resets this timer. The value must be greater than or equal to Access token TTL.
Example: access token TTL is 15 and idle refresh TTL is 60. While the user keeps working, the app renews the session and the 60-minute idle timer starts over. If they do nothing for 60 minutes, the next renewal fails and they are returned to the sign-in page.
Save
Saving updates this owner company and every dealer company that belongs directly to it. Customer companies are not changed from this page. A dealer can set customer timeouts from the dealer Settings > Auth settings page.
New values apply the next time a user signs in or the app renews their session. People who are already signed in are not signed out at the moment you select Update.
Validation
|
Rule |
Message |
|---|---|
|
The value must be a number |
TTL must be a number |
|
The value must be a whole number of minutes |
TTL must be an integer number of minutes |
|
The value must be at least 1 |
Minimum value is 1 minute |
|
The value must be at most 1440 |
Maximum value is 1440 minutes (24 hours) |
|
Idle refresh TTL must be greater than or equal to the access token TTL |
Idle refresh TTL must be greater than or equal to the access token TTL |
How the two timeouts work together
-
The user signs in and receives an access token that lasts for Access token TTL.
-
When that token expires, the app renews it in the background if the user has been active within Idle refresh TTL.
-
Each successful renewal issues a new access token and starts the idle timer again.
-
If the idle timer runs out, renewal fails and the user must sign in again.
These timeouts apply when the deployment uses built-in sign-in. They do not change session length when sign-in is handled by an external identity provider.