Overview
After fetching your first token pair, you’ll need to manage them in order to maintain access to the vehicle.
Storing access tokens
Default and Brand Select Connect Flow
By default tokens are scoped to the user’s connceted services account. This means that if there are multiple vehicles on the account - and they are selected at the time of authorization, the access token is valid for all those vehicle Ids.
To manage this, we recommend using the Smartcar User Id to link tokens to your corresponding user id. The diagram below will also allow multiple users to connect to vehicles on the same account.
Single Select Connect Flow
When using the Single Select flow, tokens are strictly scoped to the vehicle that was authorized for that Connect session. This means that if a user connects multiple vehicles under the same connected services account, each vehicle id will be tied to it’s own set of tokens.
Token expiry
Access tokens are valid for 2 hours, while refresh tokens are valid for 60 days. You can use the corresponding refresh token to fetch a new token pair once an access token has expired.
In order to maintain access to a vehicle without having a user go through Connect again, you’ll want to make sure the refresh token never expires. Whenever you fetch a new token pair, we will return a new access and refresh token.
Prior to expiry, access tokens will remain valid until their expiry when fetching a new token pair. Refresh tokens on the other hand are invalidated 1 minute after they’re used.
To avoid common 401 Authentication errors, please ensure you are persisting both the access and refresh token we return whenever you fetch a new pair.
In addition to any logic that checks access token expiry when making an API request, we strongly recommend having another job that periodically checks for refresh tokens that are close to expiry and refreshes them.
Was this page helpful?