Is there an option to add expiry date to refresh tokens?

[GasimGasimzada]

I would like to be able to set up refresh tokens to expire after some time (e.g 12hours).

[Abhishek8394]

Refresh tokens are not supposed to expire. In your case you can use an access token with 12 hour validation period and not issue refresh tokens at all.

[JonathanHuot]

In the strict RFC point of view, refresh token can have a TTL. TTL can be advertized in the provider documentation, or in a any other way (e.g. custom field in token endpoint response).

However, dunno about the current support of Django-Oauth-Toolkit.

[IvanAnishchuk]

Also, answering the original question there is REFRESH_TOKEN_EXPIRE_SECONDS -- I'm not sure the related logic is implemented correctly but the settings are there.

Further, you can subclass OAuth2Validator.save_bearer_token() method and inject arbitrary values to the token dictionary e.g.

class MyValidator(OAuth2Validator):
    @transaction.atomic
    def save_bearer_token(self, token, request, *args, **kwargs):
        super().save_bearer_token(token, request, *args, **kwargs)
        if oauth2_settings.REFRESH_TOKEN_EXPIRE_SECONDS and 'refresh_token' in token:
            token['refresh_token_expires_in'] = oauth2_settings.REFRESH_TOKEN_EXPIRE_SECONDS
        # you can inject absolutely anything here, I find it useful to add some user info to tokens, for example

-- I'm not sure it's officially the best place for this but it works and it's the way save_bearer_token does it itself with other values.

[dopry]

There isn't a built in way to add expiry to refresh tokens, but you can override classes and customize code to your needs. PR's to improve this behavior is welcome, but for now @IvanAnishchuk has put forward a workable solution.