Hi! I'm using Auth0 + Apollo + Graphcool to manage user authentication for my React Native app and it appears the user session token expires every 24 hours? I seem to lose the session 24 hours after last logging in.

@bobbyt you can control the expiration duration in your Auth0 settings 🙂

@nilan great, thanks! Will you be updating your code samples to handle cases where the token has expired so must request a new token?

Hey @bobbyt it wouldn't make sense to store that in the node, because you can issue as many tokens as you want for the same user at any given time. The token itself encodes the expiration date. This project shows off a few approaches that you can use around handling expiration and things like that: https://github.com/tictacturing/tictacturing/blob/master/src/utils/auth.js

Thanks. The problem is, because Graphcool is associated with my Auth0 account, it will not allow me to edit the integration settings to get Auth0 to issue refresh tokens. Is that a setting on your end? This is what Auth0 passes back:

// {
    //   "name":"<mailto:xxx@yyy.com|xxx@yyy.com>",
    //   "iss":"<https://yyy.auth0.com/>",
    //   "sub":"auth0|1234567d778f6e300184a6",
    //   "aud":"AbCdEpb59aOBns74F7JT2DxGJSye",
    //   "exp":1495859255, // expires
    //   "iat":1495823255 // issued
    // }

In order for Auth0 to return a refresh_token, a setting needs to be enabled but I cannot access it due to my Auth0 client being controlled by Graphcool.

Graphcool does not control your Auth0 client in any way other than verifying tokens for either User creation or authenticating requests.

Per https://auth0.com/docs/tokens/refresh-token#obtain-a-refresh-token I followed this exactly but no refresh_token is being returned. This is where they describe the settings: https://auth0.com/docs/tokens/preview/refresh-token#restrictions "Another safeguard is that the API should allow offline access. This is configured via the Allow Offline Access switch on the API Settings. If the switch is disabled, Auth0 will not return a refresh token for this API, even if you included the offline_access scope." But there does not seem to be an option anywhere to enable this in the Auth0 interface?