# Best practice for native mobile apps (session expiration? offline tokens?)

**URL:** <https://forum.keycloak.org/t/best-practice-for-native-mobile-apps-session-expiration-offline-tokens/4318>\
**Category:** Getting advice\
**Created:** [August 15, 2020, 5:33pm UTC](https://forum.keycloak.org/t/best-practice-for-native-mobile-apps-session-expiration-offline-tokens/4318 "2020-08-15T17:33:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![peterholak](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/peterholak/32/1247_2.png) [@peterholak](https://forum.keycloak.org/u/peterholak)\
**Post date:** [August 15, 2020, 5:33pm UTC](https://forum.keycloak.org/t/best-practice-for-native-mobile-apps-session-expiration-offline-tokens/4318/1 "2020-08-15T17:33:24Z")

</div>

Hi. I have a fairly typical project that has a website and a bunch of native mobile/desktop apps.

Is there any definitive information about how to best configure keycloak for such a case? The issues I have are:

- The lifetime of refresh tokens seems to be linked to the lifetime of the login session (e.g. [https://github.com/openid/AppAuth-Android/issues/531](https://github.com/openid/AppAuth-Android/issues/531)). I want the mobile app refresh token to pretty much never expire (except maybe when idle for weeks), which is how mobile apps normally behave. It seems I have to configure a very long session time then(?), which would however be bad for the website (I want a fairly short session expiration for the regular web/form login, which is accessed with regular browsers). In general, the concept of a “SSO session” seems kinda foreign for mobile apps.

- I looked into the possibility of using an offline token instead, but this use case (regular mobile apps) doesn’t seem to be what it’s meant for, based on the docs. Am I wrong here and a session with offline\_access scope is the “correct” way to achieve never-expiring mobile app login? Or is there a better way to do it?

---

<div class="post-metadata">

**Author:** ![gdelgado\_cr](https://avatars.discourse-cdn.com/v4/letter/g/a698b9/32.png) [@gdelgado\_cr](https://forum.keycloak.org/u/gdelgado_cr)\
**Post date:** [July 30, 2021, 5:28pm UTC](https://forum.keycloak.org/t/best-practice-for-native-mobile-apps-session-expiration-offline-tokens/4318/2 "2021-07-30T17:28:27Z")

</div>

> [@peterholak](#):
>
> e mobile app refresh token to pretty much never expire (except maybe when idle for weeks), which is how mobile apps normally behave. It seems I have to configure a very long session time then(?), which would however be bad for the website (I want a fairly short session expiration for the regular web/form login, which is accessed with regular browsers). In general, the concept of a “SSO session” seems kinda foreign for mobile apps.

Hello Peter, I’m facing a similar situation and was wondering how you solved it.

Any help/guidance is much appreciated, thanks!