---
schema_version: "1"
id: cb602a30c6f799f982c8272ca5ae3fc5df0d4f6267d400cc5dc18c506b635c06
title: Limit the Idle Refresh Token TTL in Connected Apps
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_limit_idle_ttl.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_limit_idle_ttl.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ac03b3089255b3fd48e2812b6ad75ee26e46db88270e0591a95486dfa4bec066
description: "For improved security, Salesforce requires a 30-day limit to the idle refresh token TTL (time-to-live). The idle TTL is the amount of time that an OAuth refresh token can be inactive before it expires. When a refresh token expires, the user or app must request a new access token. The idle TTL works as a sliding window: each time the token is used within the 30 day-period, its idle TTL resets. For flows that don't use refresh tokens, this control also caps the access token lifetime at 30 days from the last login date."
products:
  - Security
  - Cross Cloud
release: "264"
---
# Limit the Idle Refresh Token TTL in Connected Apps

For improved security, Salesforce requires a 30-day limit to the idle refresh token TTL (time-to-live). The idle TTL is the amount of time that an OAuth refresh token can be inactive before it expires. When a refresh token expires, the user or app must request a new access token. The idle TTL works as a sliding window: each time the token is used within the 30 day-period, its idle TTL resets. For flows that don't use refresh tokens, this control also caps the access token lifetime at 30 days from the last login date.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
      <colgroup>
        <col>
      </colgroup>
      <tbody>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td>

        </tr>
        <tr class="">
          <td class="slds-cell-wrap" style="vertical-align:top;">
            <p>Connected apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>,
              <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and
              <strong>Developer</strong> Editions
            </p>
            <p style="margin-bottom:0;">Connected apps can be installed in: all editions</p>
          </td>

        </tr>
      </tbody>
    </table> <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d20191e85">User Permissions Needed</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e85 ">To read, create, update, or delete connected apps:</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e85 ">Customize Application AND either Modify All Data OR Manage Connected Apps</td>

        </tr>
      </tbody>
    </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Looking for external client apps documentation on limiting the idle refresh token TTL? See [this article](https://help.salesforce.com/s/articleView?id=xcloud.eca_limit_idle_refresh_token_ttl.htm&language=en_US).

## How this Security Control Affects Your Apps

Here's what happens to your OAuth integrations when this control is turned on:

- Immediate expiration of all existing refresh tokens that have remained unused for 30 days or longer and all existing access where the last login date was more than 30 days ago.
- Ongoing enforcement of the new control. After enforcement, unused refresh tokens expire when they hit 30 days of inactivity. Long-running access tokens expire 30 days after their last login date.

This control also affects these refresh token policies:

- Refresh token is valid until revoked
- Expire refresh token after number unit of time
- Expire refresh token if not used for number unit of time

Work with your subscribers to let them know when you’re enabling these changes.

## Enable the Idle Refresh Token TTL Control

Salesforce enforces this control for connected apps. Before enforcement, here's how to turn it on. If it's already enforced, you can't edit this setting.

1. From Setup, in the Quick Find box, enter App and then click **App Manager**.
2. Find your app and click **Edit**.
3. In the API (Enable OAuth Settings) section, turn on **Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days**.
4. Save your change.

## Fix Inconsistencies with Refresh Token Policies

When this control is enforced, it affects refresh token policies for you and your subscribers. This change can introduce inconsistencies between the behavior, UI, and metadata. Here's how to update your apps to fix these inconsistencies:

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d20191e212">Refresh Token Policy</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d20191e215">Behavior Changes with Idle TTL Limit</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d20191e218">How to Fix Inconsistencies with UI, Behavior, and Metadata</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Refresh Token Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e212 ">Refresh token is valid until revoked</td>

            <td data-label="Behavior Changes with Idle TTL Limit" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e215 ">This policy is no longer valid with the idle TTL limit enforced. In the UI, this
              option becomes hidden and the policy selection changes to “Expire refresh token if not used
              for specific time” with the validity period set to 30 days.</td>

            <td data-label="How to Fix Inconsistencies with UI, Behavior, and Metadata" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e218 ">Salesforce doesn’t automatically update the app’s metadata to reflect this change. To
              update the <a href="https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_connectedapp.htm#ConnectedAppOauthPolicy" target="_blank">ConnectedAppOauthPolicy</a> metadata type: Change the
              value of the <samp class="parmname">refreshTokenPolicy</samp> field to
              <code>specific_inactivity:30:DAYS</code>
            </td>

          </tr>
          <tr class="">
            <td data-label="Refresh Token Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e212 ">Immediately expire refresh token</td>

            <td data-label="Behavior Changes with Idle TTL Limit" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e215 ">None. This policy behaves the same way it did before.</td>

            <td data-label="How to Fix Inconsistencies with UI, Behavior, and Metadata" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e218 ">Not applicable</td>

          </tr>
          <tr class="">
            <td data-label="Refresh Token Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e212 ">Expire refresh token after <samp class="parmname">number</samp>
              <samp class="parmname">unit of time</samp>
            </td>

            <td data-label="Behavior Changes with Idle TTL Limit" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e215 ">
              <p>Refresh tokens still use the validity period configured in the app policies. If it’s
                longer than 30 days, the idle TTL limit also applies. </p>
              <p style="margin-bottom:0;">For example, if the configured
                validity period is 1 year, idle tokens still expire after 30 days. With continuous use,
                tokens can last up to 1 year.</p>
            </td>

            <td data-label="How to Fix Inconsistencies with UI, Behavior, and Metadata" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e218 ">Not applicable</td>

          </tr>
          <tr class="">
            <td data-label="Refresh Token Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e212 ">Expire refresh token if not used for <samp class="parmname">number</samp>
              <samp class="parmname">unit of time</samp>
            </td>

            <td data-label="Behavior Changes with Idle TTL Limit" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e215 ">This validity period configured in this policy already works as an idle TTL with a
              sliding window. The only change is that the configured validity period can’t be longer than
              30 days.</td>

            <td data-label="How to Fix Inconsistencies with UI, Behavior, and Metadata" class="slds-cell-wrap" style="vertical-align:top;" headers="d20191e218 ">
              <p>Salesforce doesn’t automatically update the UI or metadata to reflect this change.</p>
              <ul>
                <li>In the UI, update the validity period to 30 days.</li>

                <li>In the <a href="https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_connectedapp.htm#ConnectedAppOauthPolicy" target="_blank">ConnectedAppOauthPolicy</a> metadata type: Change the
                  value of the <samp class="parmname">refreshTokenPolicy </samp> field to
                  <code>specific_inactivity:30:DAYS</code>.
                </li>

              </ul>
            </td>

          </tr>
        </tbody>
      </table>