Quick answer: Access tokens live fifteen minutes; sessions renew silently through rotating refresh tokens for up to thirty days of use. Stolen tokens age out fast, refresh reuse is detected, and members experience none of it — just an app that stays signed in.
How it works
Rotation means a copied refresh token betrays itself on second use.
Suspension and removal cut new tokens immediately; short access life bounds the tail.
Sign-out on shared devices revokes the session server-side.
Frequently asked questions
Why thirty days?
Long enough that phones feel permanently signed in, short enough that lost devices age out.
Can admins force-expire a member's sessions?
Trashing or suspending the member does exactly that.