Access tokens and refreshtoken lifetime

[Keksik]

Hello!

How long access and refresh tokens issued from MobileApp live? How often do I need to refresh access and reshres tokens? Does it worth to try to update refresh token alongside with access token? 

[Dr. McKay]

Decode the JWT and check the exp parameter, but be aware that tokens can be invalidated server-side at Valve's discretion, and nobody's sure exactly what makes that happen besides IP changes.

[Keksik]

And what about updating refresh token? Should I refresh it alongside with access token?

[Dr. McKay]

There's no reason not to.

[Nickers]

@Dr. McKay
Hi, what do I use as a key to decode refreshToken? Can't find it mentioned anywhere.

[Dr. McKay]

You don't need a key to decode it. It's just a JWT.

[Nickers]

My bad, I was trying to verify it instead of decoding...

[Dr. McKay]

I don't believe the JWT public key was ever published.

[Ultra_Om]

refreshToken when revoked has eruslt: 26, but will this error occur when logging out of all Steam devices or deleting a Steam account?

also on account with no steam guard it gave me much more than 200 days token alive
 "exp": 1779515339

I just want to know that user revoking his refreshToken on purpose (for example by https://api.steampowered.com/IAuthenticationService/RevokeToken/v1/), so I can react correctly based on this. Can a token be revoked for other reasons by Steam if you use the account normally?(No security reasons)

[Fess23]

On 10/7/2025 at 11:12 AM, Ultra_Om said:

refreshToken при відкликанні має значення eruslt: 26 , але чи виникне ця помилка під час виходу з усіх пристроїв Steam або видалення облікового запису Steam?

також на акаунті без Steam Guard це дало мені набагато більше, ніж 200 днів активності токенів
"термін дії": 1779515339

Я просто хочу знати, чи цей користувач навмисно відкликає свій refreshToken (наприклад, через https://api.steampowered.com/IAuthenticationService/RevokeToken/v1/) , щоб я міг правильно відреагувати на основі цього. Чи може Steam відкликати токен з інших причин, якщо ви користуєтеся обліковим записом звичайним способом? (Без міркувань безпеки)

In my personal experience, the session expires on its own, even if you actively use it. At the same time, the user does not deauthorize all devices or change anything related to security.