Request for update on absolute OAuth token lifetime

[tbinna]

@atlassian @Nir and the OAuth team: May I ask for a follow-up on the absolute OAuth token lifetime that was announced about nine months ago. I would like to know if there has been any progress on eliminating this limitation?

Context

About nine months ago, Atlassian changed its OAuth implementation from persistent refresh tokens to rotating refresh tokens. As part of that change, an absolute lifetime for OAuth tokens was introduced, which would mean all customer OAuth tokens would break after one year.

Unfortunately, at that stage, we could not get any guarantees from Atlassian that they would fix this problem, and we were told the work would take around nine months:

@Nir

Regarding the absolute lifetime and our migration to a new OAuth provider, unfortunately I cannot provide you any more information at the moment. The work has already been roadmapped by one of our teams and as far as I know it should be done in about 9 months, but there are no guarantees at this stage.

[dmorrow]

Hi @tbinna ,

@Nir has moved to a new role/team so I’m trying to find the right person to follow this up.

Regards,
Dugald

[NusratSultana]

Hi @tbinna ,
Atlassian is currently migrating all the auth clients to native OAuth provider. With the native implementation, as long as the clients are rotating the refresh token, they won’t have to worry about absolute lifetime. The migration is ongoing and will be finished in 2 weeks time.