Handling of refresh tokens not clear

I have an increasing number of refresh tokens, which I delete from time to time when they are older then one week. From my point of view, that activity should not exist.

I know, that a refresh token will be deleted, when logging of from HA. That definately happens, when I open HA from Desktop or as HA-App and then explicitly choose logoff.
But I use apps like wallpanel and HA from an android tablet and I configured a display user, where the header is hidden via CCH.
These apps will not explicitly logoff and so the refreh token keeps in the list.

My question: Will this token be automatically deleted at any time?
Is it a safty issue, when it keeps present?

I think they are valid for 10 years or something like that… every login gets a token. If you delete a token, it will create a new one when it next connects. I only delete old duplicated ones. My Google Assistant and iOS tokens are very old.

Yes, I understood. But I think, that my mobile apps everytime creating a new token. Due to this, I have an increasing number of old, unused refresh tokens. Displays, the family and myself have increased the number of apps :wink: And none of them, even if the menu would be available, would tab on menu button, User, log off. And last but not least I prefer to avoid giving access on the side bar :slight_smile:

Mine don’t do that.

What version of HA? I know there has been a recent change to not generate so many tokens.

I’m on 0.95.4

One or more of my devices are doing this.

If I see a token last used over a month ago I delete it.

Exactly: And that should be redesigned.
The Home Assistant should run without making it necessary to look into it in order to keep it clean.

So the solution might be: An automatism which deletes old tokens or the token “destroys” itself after being unused for a certain time.

2 Likes

I already created a feature request .
Seems to be the best approach

1 Like

Hi,
I also have problems with refresh token. Since a few weeks ago, i have to delete the .google.token file, and re-authenticate to have access to google calendar. Something changed ? Thank you