# Auth Token "expires\_in" meaning?

**URL:** https://discourse.nodered.org/t/auth-token-expires-in-meaning/57377
**Category:** General
**Created:** [28 January 2022 02:36 UTC](https://discourse.nodered.org/t/auth-token-expires-in-meaning/57377 "2022-01-28T02:36:59Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Henjoe](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/henjoe/32/52335_2.png) [@Henjoe](https://discourse.nodered.org/u/Henjoe)
#### Post date: [28 January 2022 02:36 UTC](https://discourse.nodered.org/t/auth-token-expires-in-meaning/57377/1 "2022-01-28T02:36:59Z")

</div>

Hi nodered experts,

May I know the meaning for the expires\_in in the admin API of nodered?  
I believed this is the range of time where the token will be expire, but I am not sure wether it is in minutes? hour? or days?

The 604800 means?

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/6/6/668a6f8af5cbbf637ba2886858a57015937cc08f.png)

In addition, I want my token to never get expired, is it possible?

Regards,  
Henjoe

---

<div class="post-metadata">

### Author: ![kuema](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/kuema/32/6542_2.png) [@kuema](https://discourse.nodered.org/u/kuema)
#### Post date: [28 January 2022 06:46 UTC](https://discourse.nodered.org/t/auth-token-expires-in-meaning/57377/2 "2022-01-28T06:46:36Z")

</div>

That value looks familiar, so my _guess_ is, those are seconds. 🧐

Meaning `604800 = 60 * 60 * 24 * 7`, which is one week.

---

<div class="post-metadata">

### Author: ![Henjoe](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/henjoe/32/52335_2.png) [@Henjoe](https://discourse.nodered.org/u/Henjoe)
#### Post date: [28 January 2022 06:58 UTC](https://discourse.nodered.org/t/auth-token-expires-in-meaning/57377/3 "2022-01-28T06:58:53Z")

</div>

I see!

It is not mentioned in their documentation, I guess you are right.

Thanks!

Regards,  
Henjoe

---

<div class="post-metadata">

### Author: ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [28 January 2022 12:21 UTC](https://discourse.nodered.org/t/auth-token-expires-in-meaning/57377/4 "2022-01-28T12:21:40Z")

</div>

A bearer token that never expires is VERY insecure.

The problem with bearer tokens is that they are used as a security feature but really they are only a convenience feature. The system must provide the security processing.

A token is fairly easy to intercept and copy. If there is no other security process and the token doesn't expire, the attacked has permanent access to the system.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)
#### Post date: [29 March 2022 12:22 UTC](https://discourse.nodered.org/t/auth-token-expires-in-meaning/57377/5 "2022-03-29T12:22:01Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.
