30-Day Refresh Token Expiration

[mert-ersoy]

Currently, OAuth refresh tokens become invalid exactly 30 days after they are generated. For continuously running applications like chat bots and overlays, forcing users to manually re-authorize every single month causes severe disruptions and creates a highly negative user experience.

Because of this strict limitation and the resulting user frustration, developers and users are actively looking for ways to bypass the official Kick API and Cloudflare protections just to maintain stable, uninterrupted background services.

Proposed Solution:
We request a permanent solution to this issue to keep developers within the official API ecosystem. If tokens cannot remain valid indefinitely for security reasons, we strongly suggest extending the refresh token lifespan from 30 days to at least 90 days. This compromise would drastically improve the user experience and reduce the incentive to bypass official protections.

[DigitalRedPanda]

Correct me if I am wrong, but I think you still can just refresh via an OAuth server, can't you? At least that's how I do it. You should refresh the access_token every two hours, and use the refresh_token when doing so. And in the end, you update the refresh_token, exceeding the 3d days expiration duration.

[mert-ersoy]

Correct me if I am wrong, but I think you still can just refresh via an OAuth server, can't you? At least that's how I do it. You should refresh the access_token every two hours, and use the refresh_token when doing so. And in the end, you update the refresh_token, exceeding the 3d days expiration duration.

Partially correct! We do use the refresh_token for renewals, but it has an absolute lifetime of 30 days. After 30 days, the refresh token expires permanently, and the user has to log in again manually.