---
schema_version: "1"
id: 6f62c9c5b3aef6376f201351f216d97ddc6df3a7df75f33f412cbbddd1927a66
title: Limit the Idle Refresh Token TTL in External Client Apps
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/eca_limit_idle_refresh_token_ttl.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.eca_limit_idle_refresh_token_ttl.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 268ff5e09b48db5861d8d7ed475dcea3607835ddc32208d2518e1d277d1b358e
description: "For improved security, Salesforce requires a 30-day limit to the idle refresh token TTL (time-to-live). The idle TTL is the amount of time that an OAuth refresh token can be inactive before it expires. When a refresh token expires, the user or app must request a new access token. The idle TTL works as a sliding window: each time the token is used within the 30 day-period, its idle TTL resets. For flows that don't use refresh tokens, this control also caps the access token lifetime at 30 days from the last login date."
products:
  - Security
  - Cross Cloud
release: "264"
---
# Limit the Idle Refresh Token TTL in External Client Apps

For improved security, Salesforce requires a 30-day limit to the idle refresh token TTL (time-to-live). The idle TTL is the amount of time that an OAuth refresh token can be inactive before it expires. When a refresh token expires, the user or app must request a new access token. The idle TTL works as a sliding window: each time the token is used within the 30 day-period, its idle TTL resets. For flows that don't use refresh tokens, this control also caps the access token lifetime at 30 days from the last login date.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Professional</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d14589e72">User Permissions Needed</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e72 ">To configure External Client Apps OAuth settings</td>

          <td class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e72 ">Create, edit, and delete External Client Apps</td>

        </tr>
      </tbody>
    </table>

## How this Security Control Affects Your Apps

Here's what happens to your OAuth integrations when this control is turned on:

- Immediate expiration of all existing refresh tokens that have remained unused for 30 days or longer and all existing access where the last login date was more than 30 days ago.
- Ongoing enforcement of the new control. After enforcement, unused refresh tokens expire when they hit 30 days of inactivity. Long-running access tokens expire 30 days after their last login date.

This control also affects these refresh token policies:

- Refresh token is valid until revoked
- Expire refresh token after specific time
- Expire refresh token if not used for specific time

## Enable the Idle Refresh Token TTL Control

Salesforce enforces this control for external client apps. Before enforcement, here's how to turn it on. If it's already enforced, you can't edit this setting.

1. From Setup, in the Quick Find box, find and select **External Client App Manager**.
2. Find your app and click **Edit Settings**.
3. In the OAuth Settings, find the Security section and turn on **Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days**.
4. Save your change.
5. Go to the Policies tab and find the App Authorization section. The Refresh Token Policy heading now indicates that the idle TTL limit is enforced.

![Refresh token policy UI when idle TTL limit is enforced](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/identity/images/idle_ttl_eca.png)

## Fix Inconsistencies with Refresh Token Policies

When this control is enforced, it affects refresh token policies for you and your subscribers. This change can introduce inconsistencies between the behavior, UI, and metadata. Here's how to update your apps to fix these inconsistencies:

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d14589e188">Refresh Token Policy</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d14589e191">Behavior Changes with Idle TTL Limit</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d14589e194">How to Fix Inconsistencies with UI, Behavior, and Metadata</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Refresh Token Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e188 ">Refresh token is valid until revoked</td>

            <td data-label="Behavior Changes with Idle TTL Limit" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e191 ">
              <p style="margin-bottom:0;">This policy is no longer valid with the idle TTL limit enforced. In the UI, this
                option becomes hidden and the policy selection changes to “Expire refresh token if
                not used for specific time” with the validity period set to 30 days.</p>
            </td>

            <td data-label="How to Fix Inconsistencies with UI, Behavior, and Metadata" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e194 ">
              <p>Salesforce doesn’t automatically update the app’s metadata to reflect this
                change.</p>
              <p>In the <a href="https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappoauthconfigurablepolicies.htm" target="_blank">ExtlClntAppOauthConfigurablePolicies</a>
                metadata type:</p>
              <ul>
                <li>Update the value of the <samp class="parmname">refreshTokenPolicyType</samp> field to
                  <code>SpecificInactivity</code>.
                </li>

                <li>Add a <samp class="parmname">refreshTokenValidityPeriod</samp> field and set the value
                  to <code>30</code>.</li>

                <li>Add a <samp class="parmname">refreshTokenValidityUnit</samp> field and set the value to
                  <code>Days</code>.
                </li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Refresh Token Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e188 ">Immediately expire refresh token</td>

            <td data-label="Behavior Changes with Idle TTL Limit" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e191 ">None. This policy behaves the same way it did before.</td>

            <td data-label="How to Fix Inconsistencies with UI, Behavior, and Metadata" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e194 ">Not applicable</td>

          </tr>
          <tr class="">
            <td data-label="Refresh Token Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e188 ">Expire refresh token after specific time</td>

            <td data-label="Behavior Changes with Idle TTL Limit" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e191 ">
              <p>Refresh tokens still use the validity period configured in the app policies. If
                it’s longer than 30 days, the idle TTL limit also applies. </p>
              <p style="margin-bottom:0;">For example, if the
                configured validity period is 1 year, idle tokens still expire after 30 days. With
                continuous use, tokens can last up to 1 year.</p>
            </td>

            <td data-label="How to Fix Inconsistencies with UI, Behavior, and Metadata" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e194 ">Not applicable</td>

          </tr>
          <tr class="">
            <td data-label="Refresh Token Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e188 ">Expire refresh token if not used for specific time</td>

            <td data-label="Behavior Changes with Idle TTL Limit" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e191 ">This configured validity period for this policy already works as an idle TTL
              with a sliding window. The only change is that the validity period now can’t be
              longer than 30 days.</td>

            <td data-label="How to Fix Inconsistencies with UI, Behavior, and Metadata" class="slds-cell-wrap" style="vertical-align:top;" headers="d14589e194 ">
              <p>Salesforce doesn’t automatically update the UI or metadata to reflect this
                change. </p>
              <p>In the UI, update the validity period to 30 days. </p>
              <p>In the <a href="https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_extlclntappoauthconfigurablepolicies.htm" target="_blank">ExtlClntAppOauthConfigurablePolicies</a>
                metadata type:</p>
              <ul>
                <li>Update the value of <samp class="parmname">refreshTokenValidityPeriod</samp> field to
                  <code>30</code>.
                </li>

                <li>
                  <p>Update the value of <samp class="parmname">refreshTokenValidityUnit</samp> field to
                    <code>Days</code>.
                  </p>
                </li>

              </ul>
            </td>

          </tr>
        </tbody>
      </table>