Token validation

By default, PingOne takes session validity into consideration when evaluating whether a refresh token is valid at the token or introspection endpoint. If the session is invalid, the refresh token is considered invalid even if it has not expired. Likewise, for access tokens obtained through a grant type involving a user, the same session-validity constraint applies.

A session becomes invalid after:

To decouple session validity and token validity, PingOne provides an option to skip session validation at the application level. By setting an OIDC application’s skipTokenSessionValidation property to true, the platform allows the use of valid (unexpired) access tokens and refresh tokens after the user session becomes invalid. In this case, when evaluating whether a refresh token (or access token obtained through a user grant type) is valid, the token remains valid as long as it is in good standing.