Is it ok to set access tokens to never expire? Or should we ask the user of the application to periodically re-enter their credentials?

  • That is all a matter of opinion. The responsible thing would be to to never use no_expiry so that the user and your app have a little more protection against exploits. The API takes care of reprompting the user as required. – Brock Adams Mar 13 '15 at 19:19
  • also off-topic - this question isn't specific to SE – JMP Mar 21 '15 at 5:02

Browse other questions tagged .