What is the lifetime of an access token in this system?

• A. 1 hour
• B. 24 hours
• C. 7 days
• D. 20 minutes

Answer: (D)

Access tokens are meant to be short-lived credentials that prove you’re authenticated. By limiting how long they’re valid, the system reduces the window in which a stolen token could be used. In this setup, the access token lasts twenty minutes. That duration balances security and convenience: it’s long enough for ordinary user activity, but short enough that if the token is intercepted, the potential damage is limited. A refresh token is typically used to obtain a new access token without requiring the user to re-enter credentials, so users don’t have to constantly log in even though the access token itself is short-lived. Longer lifetimes, like an hour, a day, or a week, would increase risk because a compromised token could be used for a longer period.