Hi, anyone know how Hydra manages the access token validity?

This is typically set in the login provider (the code integraring hydra with the actual identity management system). hydra stores that information in its DB. If your application makes use of the introspection endpoint, it will then be able to see if the token is still valid and if yes until when. If you let hydra issue jwts, the corresponding information is included into it via the corresponding claims.

Thanks for this part. However, if the access token is expired, when do they update its active status in the database or table? while making a request, or is there any other way they are achieving it?

The

active

claim in the introspection response is set to

false

either if the token has been revoked (here an explicit call to the revocation endpoint must have been done before), or if the token has expired based on its validity information (the not after timestemp set while creating the token). Code (pseudocode) wise it looks like

if token.NotAfter < time.now() || token.isRevoked()
  active = false
else
  active = true

Ohh thanks, so I just have to get the timestamp of the token from DB. thanks for the explanation.

Hi @icy-manchester-83109, I am having a weird problem with Hydra. I cannot login with more than one subject (email) in the same oauth2 client. I mean for the same client multiple user login is not possible. If I generate an access token for a subject, the previous loggedin subject's (email's) token is getting inactive while introspecting. Can you help me where is the issue?

Hi. Shamin, Sorry for the very belated answer. This is pretty weird behavior and I personally never encountered that. Maybe there is something wrong with your client configuration 🤷‍♂️

Thanks for the reply @icy-manchester-83109. I am looking into it...