Session expiry in Salesforce - Session timeout value for Connected Apps

Question

I am using OAUth authentication through connected apps. How can I get session timeout value(access token expiry time) as part of response during user authentication.

I am expecting "expires_in" attribute as well in the response. This link - https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_understanding_user_agent_oauth_flow.htm shows Salesforce appends token expire time in the response.

Response that I am getting-

{
  "access_token": "00D19000000Eg9i!ARMAQPHFYb1d8i11SQMI5gGNgEQexfJrQR9IHuodm2qTr9LHdcmlm_jvYMVng5gs_CYcN5_s.YkJx6ysbG1SiGjiJQAdT_H3",
  "refresh_token": "5Aep861FCftfNVCpAzffzyDwTRPXKAwLK6p_w_n99aGvRq_d_ccazXBodQhYbiXrg_HNY3im7WUq2wWpW5CaT_H",
  "signature": "nYKG7fjDyZ71cSsjci2fc9jsr02kHIDDmSTMCFblCo4=",
  "scope": "refresh_token full",
  "id_token": "eyJraWQiOiIyMDIiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdF9oYXNoIjoiZlVRV2o4SldHSkh2M0NvOGpXMGlSdyIsInN1YiI6Imh0dHBzOi8vdGVzdC5zYWxlc2ZvcmNlLmNvbS9pZC8wMEQxOTAwMDAwMEVnOWlFQUMvMDA1MTkwMDAwMDE2VmlMQUFVIiwiYXVkIjoiM01WRzlOYzFxY1o3QmJaM3dZaFhzdl9jdU1YaHZ2Z25uZDlEaDA0NmpubXVNVkZLa0dyZy5uQ1hqLmhNZmRSX0dmdncuNE9ET1BRSjVCR1BPcmVxRSIsImlzcyI6Imh0dHBzOi8vdGVzdC5zYWxlc2ZvcmNlLmNvbSIsImV4cCI6MTQ2ODMzODAwMSwiaWF0IjoxNDY4MzM3ODgxfQ.SyYrPYnCI8DgB94NDd37lZ-n3w2EKLcoCJyfymvCjNzilVch6muOGAfSuItgWwtRyAseRiIc5LPVZN5hCkQUA6DDM2XxHBKDiu-INqX6_8CfAjB4Is7Y7K6xwUE9FGUbVhnx2O-H8BQqu1g0etCdK_dZTce1O1CCriQ00Y8VocUwWorslyaElLpGv3t3ZL2VyKeoYLXScK8atU4s4EuppV1dsLpRxsv2ex_956LIVLtkst57L9We6DN-5dhw-pkI_q3YFdKbLkawJsYQBCAGfskpCX6Cr1C8Nv88WbY83Zd_MqwB8wPQWQk56-sUk7EO5lh8JJQ3I6aZNjidO6hJSUvNzXV3Vp_YuCWVeogEqWDA7c5oFvXE_HynU7AOwPL_IxJbGe6QNFE6B_gl3pJZtAOkNx_dzHsXn70GOADoJ_WqW_BPAP3wzFpmjDdVnnZcZ3UTLGo6VCGk0F8w0k7Hfyjp34r-yiepdFe98lukusYM7mtkGKsW3ok7qaQ_CINu8hljGJsKoLer47DUGQ84xenFZ6kHLN978i4b_SciWj4KoY4RkV8VBPFfEJfE0N4gRu2xRb55MVKu3PMBEWUkiE0kMiW0-LiBSrmYyYAsyqReoB9048yUm7a7lzN55RfVHNSSZz58C6Y0aTlMjWPFtBoIuvHt7THvqisvswDXSdg",
  "instance_url": "",
  "id": "https://test.salesforce.com/id/00D19000000Eg9iEAC/005190000016ViLAAU",
  "token_type": "Bearer",
  "issued_at": "1468337881077"
}

Answer 1

If you read properly in the link you have provided, The expires_in attribute is given on the call back URL and not as web service response.

Even if you get expires_in there is still a catch. The expires_in will only tell the value from Org session settings/profile session settings and which can't be used to decide the actual timeout value.

You have 2 session settings.

1. Session Settings(Org Wide).
2. Profile level Session settings.

Profile level session settings overrides the Org wide session settings. Now you can set the value from 15 mins to 12 Hours(The same value we get in expires_in attribute). So the session automatically getting logged out or access token getting discarded if user is inactive for given period of time. (If user is active during that timeout duration, the final logout time will also extend) The systems tracks the last active time to determine the final lockout time.

The help on session setting states.

The last active session time value isn’t updated until halfway through the timeout period. So if you have a 30-minute timeout, the system doesn’t check for activity until 15 minutes have passed. For example, if you update a record after 10 minutes, the last active session time value isn’t updated because there was no activity after 15 minutes. You’re logged out in 20 more minutes (30 minutes total), because the last active session time wasn’t updated. Suppose that you update a record after 20 minutes. That’s 5 minutes after the last active session time is checked. Your timeout resets, and you have another 30 minutes before being logged out, for a total of 50 minutes.

So if you know the last time when your API was hit with the session ID and the timeout period setting in your org.

Assuming that the login operation succeeds, the resulting payload contains both the session ID and the API service endpoint URL. Note that the session expires after two hours of inactivity (by default), and every time the API is called, the session inactivity timer is reset to 0.

So if you know the expires_in and only last activity time then only you can decide the validity of access token and ask for new token using refresh tokens.