Skip to content

Document Access Token expiry feature - #144

Merged
anttiviljami merged 2 commits into
mainfrom
claude/access-token-expiry-docs-j9vq87
Aug 20, 2026
Merged

Document Access Token expiry feature#144
anttiviljami merged 2 commits into
mainfrom
claude/access-token-expiry-docs-j9vq87

Conversation

@anttiviljami

Copy link
Copy Markdown
Member

Summary

Updates authentication documentation to reflect the new Access Token expiry feature, allowing tokens to be created with optional configurable expiration times (30 seconds to 365 days).

Key Changes

  • access-tokens.md: Added documentation for the expires_in parameter with examples showing both duration strings ('30d') and seconds format, plus response examples including the expires_at timestamp
  • token-types.md: Updated Access Token lifetime description from "Long-lived (no expiry)" to "Configurable expiry, up to 365 days (valid until revoked if unset)" and added code example showing expires_in usage
  • authentication.md: Clarified that Access Tokens are "scoped tokens" (not "long-lived") and updated getting started steps to mention optional expiry configuration
  • security.md: Updated Access Token descriptions to emphasize the optional expiry feature and recommend setting expiry at creation to limit exposure from leaked tokens

Notable Details

  • Documented that tokens without expires_in remain valid until revoked (backward compatible)
  • Clarified that expired tokens are automatically invalidated and drop from the token list
  • Noted that standard API tokens support up to 365 days expiry, while other token types are capped at 7 days
  • Updated all references from "long-lived" to more accurate descriptions reflecting the new configurable nature

https://claude.ai/code/session_01PxC1XqBCkJPTexQHykNozq

claude added 2 commits August 20, 2026 07:43
Access tokens now support an optional expiry set at creation
(expires_in as seconds or a duration string). Replace the incorrect
'no expiration' / 'long-lived' wording across the auth docs and
document the expires_in parameter and exp claim.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PxC1XqBCkJPTexQHykNozq
…etails

The access-token-api main branch landed follow-up changes today: API
tokens can now expire up to 365 days out (other ephemeral token types
stay capped at 7 days), expiring tokens are persisted/listed/revocable
like any other token, and the create response returns an expires_at
timestamp. Update the auth docs to reflect the exact bounds and
behavior instead of the earlier generic 'configurable expiry' wording.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PxC1XqBCkJPTexQHykNozq
@anttiviljami
anttiviljami merged commit 0e80f49 into main Aug 20, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants