Configure mobile app session lifetime

Control how long your users stay signed in to the mobile app before it asks them to sign in again. Raise the lifetimes to keep users signed in across several weeks, or lower them to meet a stricter security policy.

In .NET 8 and later, two system settings control this. They replace the token lifetime fields on the mobile client, which are unavailable because the Single Sign On page does not exist in those versions.

📘

Note

These settings exist only in .NET 8 and later. In .NET Framework 4.8, the mobile client on the Single Sign On page still controls these lifetimes. See Set up a single sign-on (SSO) client.

Prerequisites

Before you change these settings, make sure you have the following:

• A site running .NET 8 or later.
• Membership in the ISC_System or ISC_Implementer role. No other role can edit these settings.

Settings reference

Both settings are global, so a change applies to every website on the site.

Mobile Refresh Token Lifetime Minutes – How long each refresh token stays valid. Every refresh issues a new token with this lifetime. The default value is 30240 minutes (21 days).

Mobile Absolute Refresh Token Lifetime Minutes – The longest a session lasts, measured from the initial sign-in. Refreshing never extends a session past this limit. The default value is 64800 minutes (45 days).

The following table maps each setting to the mobile client field it replaces. The Single Sign On fields are in seconds and these settings are in minutes, so divide your existing values by 60.

Change the settings

1. Go to the Admin Console > Administration > System > Settings.
2. Select Global Defaults in the Configuring list. Both settings are global, so a website-specific selection does not expose them.
3. Select the System Settings tab.
4. Find Mobile Refresh Token Lifetime Minutes and Mobile Absolute Refresh Token Lifetime Minutes in the Security section.
5. Enter the number of minutes for each setting.
6. Click Save.

To return a setting to its shipped value, click Restore default next to it.

📘

Note

Look under System Settings, not under the Mobile App tab. The Mobile App tab configures app features rather than authentication.

How the two settings work together

Every refresh gives the mobile app a new refresh token. Mobile Refresh Token Lifetime Minutes sets the lifetime of that token, so it determines how long the app can stay idle before the session dies.

Mobile Absolute Refresh Token Lifetime Minutes caps the total session, measured from the initial sign-in. Refreshing never pushes a session past this cap. When the cap passes, the refresh request returns 400 and the user signs in again.

Set the absolute lifetime higher than the refresh lifetime. When the absolute cap is the smaller of the two, it decides every session length and the refresh lifetime has no effect.

Scope

These settings apply only to clients that authenticate as the mobile client, which covers the Commerce Mobile app and any custom app built on the Commerce Mobile SDK. They do not affect users who sign in through the storefront or the Admin Console. Those sessions use Site Timeout Minutes and the Remember Me settings instead.