🚀 Feature: Decouple Pocket ID session length from OIDC client #199

New Issue

OVERLORD · 2025-10-07T00:05:44+03:00

OVERLORD commented

2025-10-07 00:05:44 +03:00

Originally created by @RealOrangeOne on GitHub.

Feature description

Currently, the session duration of Pocket ID is the same as the session duration for each client. It should be possible to decouple these, possibly by specifying either a single system-wide value, or per-client.

Pitch

For Pocket ID itself, a session duration quite short makes sense, since it shouldn't be logged in to that often, and reducing it helps implement #544.

However, having to re-authenticate with logged in services every hour (by default) is fairly tedious and doesn't make sense for quite a few services.

Originally created by @RealOrangeOne on GitHub. ### Feature description Currently, the session duration of Pocket ID is the same as the session duration for each client. It should be possible to decouple these, possibly by specifying either a single system-wide value, or per-client. ### Pitch For Pocket ID itself, a session duration quite short makes sense, since it shouldn't be logged in to that often, and reducing it helps implement #544. However, having to re-authenticate with logged in services every hour (by default) is fairly tedious and doesn't make sense for quite a few services.

OVERLORD added the feature needs more upvotes labels 2025-10-07 00:05:44 +03:00

OVERLORD closed this issue

2025-10-07 00:05:45 +03:00

OVERLORD commented

2025-10-07 00:05:46 +03:00

@RealOrangeOne commented on GitHub:

I think I meant the refresh token in this case, but as you say if that's already 30 days, there's clearly something else going on, so I'll do some more digging.

@RealOrangeOne commented on GitHub: I think I meant the refresh token in this case, but as you say if that's already 30 days, there's clearly something else going on, so I'll do some more digging.

OVERLORD commented

2025-10-07 00:05:46 +03:00

@stonith404 commented on GitHub:

The session duration of Pocket ID is not linked to the expiration of the access token that clients receive, the access token expiration is set to one hour.

Clients should use the refresh token provided by Pocket ID, which is valid for 30 days, to renew the access token. As the access token can be refreshed we're not planning to customize the access token expiration.

@stonith404 commented on GitHub: The session duration of Pocket ID is not linked to the expiration of the access token that clients receive, the access token expiration is set to one hour. Clients should use the refresh token provided by Pocket ID, which is valid for 30 days, to renew the access token. As the access token can be refreshed we're not planning to customize the access token expiration.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#199