As the name suggests, the 24H access token only lasts for 24 hours, as it is meant to be a resource for you to get up and running without having to configure and set up an application and OAuth first. If you need longer sessions, you need to use OAuth to obtain an access token and a refresh token. The access token is used to authorize requests, and the refresh token is used to create a new access token before the old one expires.
- The exact lifetimes are returned with every token response, in
expires_inandrefresh_token_expires_in. Read them from there rather than relying on fixed values. - Each time you use the refresh token, you receive a new access token and a new refresh token, which replaces the old one.
- As long as you refresh before the refresh token expires, you can keep the session alive for as long as you need. If the refresh token expires (for example because your server was down for too long), you need to log in through the browser again.
- Sessions can also be ended by Saxo, for example when disclaimers change or after security changes. Your application should detect a failed refresh and notify you to log in again, rather than keep retrying.
More Resources