Access tokens and refreshtoken lifetime

[Keksik]

Hello!

How long access and refresh tokens issued from MobileApp live? How often do I need to refresh access and reshres tokens? Does it worth to try to update refresh token alongside with access token? 

[Dr. McKay]

Decode the JWT and check the exp parameter, but be aware that tokens can be invalidated server-side at Valve's discretion, and nobody's sure exactly what makes that happen besides IP changes.

[Keksik]

And what about updating refresh token? Should I refresh it alongside with access token?

[Dr. McKay]

There's no reason not to.

[Nickers]

@Dr. McKay
Hi, what do I use as a key to decode refreshToken? Can't find it mentioned anywhere.

[Dr. McKay]

You don't need a key to decode it. It's just a JWT.

[Nickers]

My bad, I was trying to verify it instead of decoding...

[Dr. McKay]

I don't believe the JWT public key was ever published.

[Ultra_Om]

refreshToken when revoked has eruslt: 26, but will this error occur when logging out of all Steam devices or deleting a Steam account?

also on account with no steam guard it gave me much more than 200 days token alive
 "exp": 1779515339

I just want to know that user revoking his refreshToken on purpose (for example by https://api.steampowered.com/IAuthenticationService/RevokeToken/v1/), so I can react correctly based on this. Can a token be revoked for other reasons by Steam if you use the account normally?(No security reasons)