---
schema_version: "1"
id: 8685771a0caab26d7164cdcdc39f3627794bfc793cadb7208321bfb168bd5748
title: Limit the Idle Refresh Token TTL (Time-to-Live) to 30 Days
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_security_idle_refresh_token_ttl.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_idle_refresh_token_ttl.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 7b73568869bc7c4c5f054599fff306c73e36b06f4745cc1109bc321c4991e5e0
description: "Protect your data from unauthorized use of old, idle refresh tokens. For improved external client app and connected app security, set a 30-day limit to the idle refresh token TTL, which is the amount of time a refresh token can be inactive before it expires. The idle TTL works as a sliding window: each time the token is used within the 30-day period, its idle TTL resets."
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Limit the Idle Refresh Token TTL (Time-to-Live) to 30 Days

Protect your data from unauthorized use of old, idle refresh tokens. For improved external client app and connected app security, set a 30-day limit to the idle refresh token TTL, which is the amount of time a refresh token can be inactive before it expires. The idle TTL works as a sliding window: each time the token is used within the 30-day period, its idle TTL resets.

**Where:** This change applies to Lightning Experience and Salesforce Classic in all editions.

**How:** In your external client app or connected app settings, turn on **Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days**. When you enable the limit, the refresh token policies UI changes slightly, with a new heading and three policy options instead of four. Here's an example for external client apps (1) and for connected apps (2).

![External client app refresh token policies with UI changes after the idle refresh token TTL is enforced.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-salesforce_release_notes-260-0-0-production-enus/ba62a63b-6cd1-440e-8d24-e867afab0363/salesforce_release_notes/images/security/eca_idle_ttl.png)

![External client app refresh token policies with UI changes after the idle refresh token TTL is enforced.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-salesforce_release_notes-260-0-0-production-enus/ba62a63b-6cd1-440e-8d24-e867afab0363/salesforce_release_notes/images/security/ca_idle_ttl.png)

Here’s how this limit changes the refresh token policy behavior for you and for subscribers.

![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-salesforce_release_notes-260-0-0-production-enus/ba62a63b-6cd1-440e-8d24-e867afab0363/images/icon_warning.png)

Warning For the "Refresh token is valid until revoked" and "Expire refresh token if not used for specific time" policies, the limit introduces inconsistencies with the UI, behavior, and metadata. To fix these inconsistencies, update your apps' UI and metadata to match the behavior, and encourage subscribers to do the same. For information about what specific updates to make, see the resources linked in the See Also section.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d31829e84">Refresh Token Policy</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d31829e87">Behavior Changes</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="Refresh Token Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d31829e84 ">
            <p>Refresh token is valid until revoked</p>
            <p style="margin-bottom:0;">This policy name is the same for external client
              apps and connected apps.</p>
          </td>

          <td data-label="Behavior Changes" class="slds-cell-wrap" style="vertical-align:top;" headers="d31829e87 ">
            <p>This policy is no longer valid with the idle TTL limit enforced. In the UI, this option
              becomes hidden and the policy selection changes to “Expire refresh token if not used for
              specific time” with the validity period set to 30 days.</p>
            <p style="margin-bottom:0;">Salesforce doesn’t automatically
              update the app’s metadata to reflect this change. To fix the mismatch, update the external
              client app or connected app metadata.</p>
          </td>

        </tr>
        <tr class="">
          <td data-label="Refresh Token Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d31829e84 ">
            <p>Immediately expire refresh token</p>
            <p style="margin-bottom:0;">This policy name is the same for external client
              apps and connected apps.</p>
          </td>

          <td data-label="Behavior Changes" class="slds-cell-wrap" style="vertical-align:top;" headers="d31829e87 ">Refresh tokens still use the validity period configured in the app policies. If it’s
            longer than 30 days, the idle TTL limit also applies. For example, if the configured validity
            period is 1 year, idle tokens still expire after 30 days. With continuous use, tokens can
            last up to 1 year. </td>

        </tr>
        <tr class="">
          <td data-label="Refresh Token Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d31829e84 ">
            <p>In external client apps—Expire refresh token after specific time</p>
            <p style="margin-bottom:0;">In connected
              apps—Expire refresh token after <samp class="parmname">{number}</samp>
              <samp class="parmname">{unit of time}</samp>
            </p>
          </td>

          <td data-label="Behavior Changes" class="slds-cell-wrap" style="vertical-align:top;" headers="d31829e87 ">Refresh tokens still use the validity period configured in the app policies. If it’s
            longer than 30 days, the idle TTL limit also applies. For example, if the configured validity
            period is 1 year, idle tokens still expire after 30 days. With continuous use, tokens can
            last up to 1 year.</td>

        </tr>
        <tr class="">
          <td data-label="Refresh Token Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d31829e84 ">
            <p>In external client apps—Expire refresh token if not used for specific time</p>
            <p style="margin-bottom:0;">In
              connected apps—Expire refresh token if not used for <samp class="parmname">{number}</samp>
              <samp class="parmname">{unit of time}</samp>
            </p>
          </td>

          <td data-label="Behavior Changes" class="slds-cell-wrap" style="vertical-align:top;" headers="d31829e87 ">
            <p>This validity period that you configure for this policy already works as an idle TTL
              with a sliding window. The only change is that the configured validity period now
              can’t be longer than 30 days. </p>
            <p style="margin-bottom:0;">Salesforce doesn’t automatically update the UI and
              metadata to reflect the new behavior. To match the behavior, set the validity period
              to 30 days and encourage subscribers to do the same. If the validity period is
              longer than 30 days, you get an error if you try to save any changes to the
              policy.</p>
          </td>

        </tr>
      </tbody>
    </table>

#### See Also

- [_Salesforce Help_: Limit the Idle Refresh Token TTL in External Client Apps](https://help.salesforce.com/s/articleView?id=xcloud.eca_limit_idle_refresh_token_ttl.htm&language=en_US)
- [_Salesforce Help_: Limit the Idle Refresh Token TTL in Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_limit_idle_ttl.htm&language=en_US)