Hi , i have a doubt - is the behaviour same if token is generated using the below api call or password.signin() . I am seeing that refresh token produced by password.signin() is getting invalid if Enable session inactivity detection is turned on my project after the defined period , but not for the refresh token produced using the below descope api call

<https://api.descope.com/oauth2/v1/token>

Hi Ritik The behavior you're observing is expected and is due to how sessions are handled for the two different token generation methods. When tokens are generated using password.signIn(), they are created as part of a Descope native authentication flow, which establishes a Descope session. Because of this, session inactivity detection applies to that session. If "Enable session inactivity detection" is enabled in the project settings, the session (and therefore the refresh token associated with it) will be invalidated after the configured inactivity period. In contrast, tokens generated using the OIDC token endpoint (/oauth2/v1/token*)* are part of the OAuth/OIDC token exchange flow and are not tied to the same Descope session object created by native authentication flows. As a result, session inactivity detection does not invalidate refresh tokens issued through this endpoint. Since refresh token rotation is disabled in your project, the refresh token issued through /oauth2/v1/token will remain valid until it expires or is explicitly revoked, regardless of session inactivity settings. Same added on the ticket as well https://app.devrev.ai/descope/works/TKT-1381