My Oracle Support Banner

Oracle Access Manager (OAM) Using An OAUTH Refresh Token To Retrieve ACCESS TOKEN Results In A Hard Coded 15 Minutes Expiry Time (Doc ID 2737464.1)

Last updated on SEPTEMBER 25, 2023

Applies to:

Oracle Access Manager - Version and later
Information in this document applies to any platform.



  • Access token expiry is set at the domain level to be 5 minutes (300 seconds).
  • When performing a grant_type=authorization_code call, the access token is returned with an expires in 300 message and the jwt information inside the token has an "iat" and "exp" value that equals 5 minutes (eg exp minus iat = 300).
  • When using a refresh token to retrieve a new access token, the Access Token expiry is set to 15 minutes inside the jwt. (i.e exp minus iat = 900).
  • This is not a value set by any of our configurations for tokens at the domain level and appears to be hard coded.
  • The "expires in" message still indicate 300 however





To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!

In this Document

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.