Is it ok to set access tokens to never expire? Or should we ask the user of the application to periodically re-enter their credentials?

closed as primarily opinion-based by Brock Adams, Tim Stone Mar 16 '15 at 5:24

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • That is all a matter of opinion. The responsible thing would be to to never use no_expiry so that the user and your app have a little more protection against exploits. The API takes care of reprompting the user as required. – Brock Adams Mar 13 '15 at 19:19
  • also off-topic - this question isn't specific to SE – JonMark Perry Mar 21 '15 at 5:02

Browse other questions tagged .