Session and token handling

When your client logs in using the userpass authentication method or an AppRole, it receives a token with a default lifetime of 15 minutes. It can be renewed to a maximum token lifetime of 24 hours.

Repeated failed userpass or AppRole logins can temporarily block new token issuance. For response handling and retry guidance, see Handle authentication lockouts.

Best practices for token renewal

• Renew only when necessary: Renew the token only when needed to minimize active tokens and reduce security risks.
• Renewal duration: Specify the exact time required for upcoming operations when renewing the token.
• Revoke unused tokens: Revoke tokens immediately if they are no longer needed.

Implementation tips

• Automate token management: Use automated checks to handle token renewals and revocations in your client.
• Error handling: Ensure your application handles token expiration gracefully and authenticates again when necessary.