Aaron Parecki

Yes, the client needs to be able to handle unexpected expiration of both the AT and RT, which tbh is more an argument that the AS should never return expires_in than an argument that it should return it for both tokens.

The way I like to think about it is:

If the client knows when the AT will (likely) expire, it can proactively refresh the token.

There is nothing the client can do differently if it knows when the RT will (likely) expire.

Even just being in a car stresses me out, not to mention being in control of one 😅