search

thephpleague / oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server
https://oauth2.thephpleague.com
MIT License
6.52k stars 1.12k forks source link

Multiple tokens valid at the same time #1151

Closed ceresaconsultoria closed 3 years ago

ceresaconsultoria commented 3 years ago

Each time the application is authorized, a new token is generated and the old one is not revoked.

Sephster commented 3 years ago

This is expected behaviour. Access tokens will remain until they are explicitly revoked by the user or expire. They don't automatically get revoked when a new one is generated.

You shouldn't need to generate a new access token if you already have a valid one. I hope this answers your issue but if you have any follow up points please just shout.

Thanks.