SqlOS

AuthServer

Security Settings

Configure session lifetimes and token expiration.

4 sections

Security settings control how long sessions and tokens remain valid.

Configuration#

Dashboard: Auth Server > Security

Admin API:

BASH
# Get current settings
curl http://localhost:5062/sqlos/admin/auth/api/settings/security
 
# Update settings
curl -X PUT http://localhost:5062/sqlos/admin/auth/api/settings/security \
  -H "Content-Type: application/json" \
  -d '{
    "refreshTokenLifetimeMinutes": 10080,
    "sessionIdleTimeoutMinutes": 1440,
    "sessionAbsoluteLifetimeMinutes": 43200
  }'

Settings#

SettingDefaultDescription
Refresh token lifetime7 daysHow long a refresh token is valid
Session idle timeout1 daySession expires after inactivity
Session absolute lifetime30 daysHard expiration regardless of activity

Access token lifetime#

The access token lifetime is configured separately in startup code since it affects JWT generation:

CSHARP
builder.AddSqlOS<AppDbContext>(options =>
{
    options.AuthServer.AccessTokenLifetime = TimeSpan.FromMinutes(15);
});

Reading settings in code#

CSHARP
var settings = await settingsService.GetResolvedSecuritySettingsAsync(ct);
 
// settings.RefreshTokenLifetime    → TimeSpan
// settings.SessionIdleTimeout      → TimeSpan
// settings.SessionAbsoluteLifetime → TimeSpan