Can sessions persist, or do they need to be constantly refreshed?

[GreenFootballs]

I've noticed that sessions created with atproto.server.createSession only last for a short time, and then need to be refreshed with the refreshJwt token and atproto.server.refreshSession.

Is there a way to make a session persist longer, or indefinitely? If not, would there be any problem with always calling atproto.server.refreshSession and saving the new tokens before any other operation?

[Matrix89]

I assume you're not using the default @atproto/api client as it automatically refreshes the session for you.

No, access token expiration time is handled server side and by default it's set to 120 minutes, same goes for the refresh token but it's set for 90 days.

Ideally you shouldn't call refreshSession needlessly, because:

• It's wasteful
• It adds latency because you have to make multiple calls
• It eats up your quota, currently 3000 requests per 5 minutes IIRC

But if you're just testing that shouldn't be a problem

[GreenFootballs]

So the way to handle this would be to attempt to call atproto.repo.createRecord (for example) and if it fails with an expired token, then do the refresh?

I guess atproto.server.getSession could be used to check for expired tokens, but again that's another call.

[thepudds]

It eats up your quota, currently 3000 requests per 5 minutes IIRC

Quick side question: is there any documentation of the quota? And might it return 403 errors if the quota is exceeded? (I saw some 403 errors that stopped happening after a few minutes).

(And sorry, probably wrong place to ask).

[Matrix89]

@GreenFootballs Yep, that's how @atproto/api does it

[Matrix89]

@thepudds That's all I know #697 (reply in thread)

[GreenFootballs]

Thanks. (BTW I really appreciate the quick responses to questions.)

[dholms]

Yup @Matrix89 nailed it

When we get around to doing an auth revamp, we'll add in something for longstanding tokens, for something like bots.

But access tokens are stateless and therefore must have a short expiration time.

I believe we do return 403 when being rate-limited. Did you receive something else?

(closing for now, but feel free to continue chatting)

[thepudds]

Hi @dholms

I believe we do return 403 when being rate-limited. Did you receive something else?

I received a set of 403s while testing some things, and my guess was I was being rate limited, but I wasn't sure of the cause at the time.

Thanks @dholms and @Matrix89 for the quick answers!