---
title: "Expiry of OAuth refresh tokens"
slug: "expiry-of-oauth-refresh-tokens"
abstract: "Modify your authentication logic to handle refresh token expiration gracefully."
---
# Expiry of OAuth refresh tokens

Our authentication system no longer allows refresh tokens with an indefinite lifetime. They now expire after 90 days. Depending on the [OAuth grant](https://doc.sitecore.com/ch/en/developers/cloud-dev/oauth-tokens.html "OAuth tokens") that you are using, there might be specific changes to your implementation that you must make.

## If you use a resource owner password credentials grant

If your integration is created using the resource owner password credentials grant, no changes are required.

<details>
<summary>Example</summary>

```csharp
var passwordGrant = new OAuthPasswordGrant
{
    ClientId = "<YOUR_CLIENT_ID>",
    ClientSecret = "<YOUR_CLIENT_SECRET>",
    UserName = "<YOUR_USERNAME>",
    Password = "<YOUR_PASSWORD>"
};

IWebMClient client = MClientFactory.CreateMClient(new Uri("<YOUR_URL>"), passwordGrant);

```

</details>

## If you use a refresh token grant with C# Web SDK

If your integration is created using the refresh token grant, then changes might be required if the refresh token is never updated.

When a refresh token expires, your integration should automatically request a new one from the authentication server. If an expired refresh token is provided, Content Hub will return a HTTP 401 error, so you need to update your integration to securely store and manage refresh tokens, ensuring they are not exposed to unauthorized access.

<details>
<summary>Example</summary>

If you're currently using the following:

```csharp
string refreshToken = await LoadRefreshTokenAsync();
var refreshGrant = new OAuthRefreshTokenGrant
{
    ClientId = "<YOUR_CLIENT_ID>",
    ClientSecret = "<YOUR_CLIENT_SECRET>",
    RefreshToken = refreshToken
};

IWebMClient client = MClientFactory.CreateMClient(new Uri("<YOUR_URL>"), refreshGrant);

```

Then use this instead:

```csharp
string refreshToken = await LoadRefreshTokenAsync();
var refreshGrant = new OAuthRefreshTokenGrant
{
    ClientId = "<YOUR_CLIENT_ID>",
    ClientSecret = "<YOUR_CLIENT_SECRET>",
    RefreshToken = refreshToken
};

IWebMClient client = MClientFactory.CreateMClient(new Uri("<YOUR_URL>"), refreshGrant);
client.RefreshTokenReceived += async (sender, eventArgs) =>
{
    await StoreRefreshTokenAsync(eventArgs.RefreshToken);
};

```

</details>

## If you use a refresh token grant without C# Web SDK

If your integration is created without using the C# Web SDK but it does use the refresh token grant, you must update the initial refresh token with the new refresh token returned in a successful token response.