How Long Should a Session Last?
By The Alt Auth Team
Ask three engineers how long a session should last and you will get an hour, a week, and "until they log out". All three can be right, because the answer depends entirely on what a stolen token can do and how quickly you can take it back.
The real question is revocation
A signed token is valid until it expires, whether or not you have since blocked the account. That is the trade: verification without a database lookup, at the cost of a window where a revoked user is still admitted. A short lifetime shrinks that window. Everything else in this decision follows from how big a window you can live with.
Reasonable defaults
- Consumer product, low blast radius: hours to days, refreshed silently.
- Anything touching money or personal data: minutes, with a refresh path.
- Admin and staff tooling: short, always, and re-authenticate for destructive actions.
- Never issue a token that outlives the account it belongs to — check on refresh, not just on issue.
Whatever you choose, it should be a setting rather than a constant compiled into three services. Token lifetime is configurable per project in Alt Auth from the Starter plan, alongside failed-login alerts (every plan) and IP rules that block addresses, ranges and countries (from Pro) for the cases where a short lifetime is not enough on its own.