Forge corrected TTL for offline user impersonation tokens
- Announced
- APIs
- forge-core-platform, forge-internal-onboarding
- Severity
- info, set by
reef/atlassian-rule-v1 - Source
- https://developer.atlassian.com/changelog/#CHANGE-3426
What's changing We fixed an issue where the ttl returned for Forge Remote offline user impersonation tokens could incorrectly report 30 minutes, even though the token remained valid for up to four hours.
The returned ttl now accurately reflects the token’s remaining validity. This change only affects the reported value and does not alter the actual token lifetime.
What you need to do If your app uses a fixed 30-minute token-refresh workaround, update it to use the returned ttl value from the offlineUserAuthToken mutation. This allows your app to cache it longer and refreshes tokens less often than previously.
The text above is Atlassian's. reef added the severity, the dates it could read from the text, and the endpoints and scopes named in code.