As you've learned, the
exp that you pass as part of the JWT claims (the thing you use to get the access token) doesn't have anything to do with how long the access token is valid for.
exp parameter controls how long your JWT (though I think you're technically sending a JWS, JSON Web Signature, to Salesforce) is valid for. If your JWT gets to Salesforce, and Salesforce's server time is beyond that of the
exp timestamp, then Salesforce will reject the JWT.
The validity of your access token is based on one of two session timeout policies.
- Salesforce will first check to see if there's a specific session policy for the connected app that you're using to access Salesforce
- Failing that, Salesforce will default to the org-level session policy
If you make an api call using a given access token before it expires, the access token's expiration timer will be reset.
So while you can, theoretically, keep making requests at regular intervals to keep an access token fresh, that's not something I would rely on. Hardcoding things is usually a red flag. A well-built, robust system that is making calls to Salesforce should have a mechanism to detect whether or not the access token is expired, and to get a new access token if that happens.
The simplest such mechanism is to simply try to get a new access token before every call to Salesforce. If your current access token is still valid, Salesforce will simply return the same access token you already had (prior to sending a new JWT to Salesforce).