[Enhancement]: Better handing of REFRESH_TOKEN_EXPIRY within the mobile application #1338

New Issue

2026-04-24T23:57:34+02:00

adam commented

2026-04-24 23:57:34 +02:00

Originally created by @ZLoth on GitHub (Jan 28, 2026).

Describe the Feature/Enhancement

Per https://www.audiobookshelf.org/docs/#security, ABS uses the variable REFRESH_TOKEN_EXPIRY to control how long a session is valid in the ABS mobile client. As of 2.31.0, this is 2592000 seconds or 30 days. It would be helpful if, on a first app access of the day, the following occurs:

Five days to one day before session expiration: A pop-up occurs within the app giving the user to option to revalidate their login now or postpone until tomorrow
Day of token expiration: The user is redirected to the server screen to revalidate their login.

Why would this be helpful?

Yesterday afternoon, I was driving around and lost access to the ABS controls. The audiobook kept on playing, but I could not pause or stop playback, nor could I see the status as the login screen appeared with a message about token expiration. Thank goodness this occurred while I was in a parking lot waiting to pick up dinner, but if I was driving, I would had to find a safe place to pull over. (Note: Fixing a login issue is NOT a good reason to pull into the emergency lane). With Authentik integrated as a SSO provider plus using 1Password as my password manager, this isn't a simple relogin process on mobile.

Future Implementation (Screenshot)

I think that it would be good if the user is prompted to revalidate their credentials a few days prior to the token expiration, and as part of the first login on the application for the day. As an example:

Starting 5 days prior to the expiration: The user sees a pop-up with the message "Your credentials will be expiring on Sunday, February 1st." with the button to either "Revalidate now" or "Postpone until tomorrow".
Day of token expiration: The user receives a pop-up message "Your credentials have expired." with the button to revalidate now.

The five day setting should be controlled from the ABS server with a setting to change it from a one-day notice up to a nine-day notice.

Audiobookshelf App Version

Android App - 0.11.0

Current Implementation (Screenshot)

No screenshot, but how about some log files?

Log Files.zip

Originally created by @ZLoth on GitHub (Jan 28, 2026). ### Describe the Feature/Enhancement Per https://www.audiobookshelf.org/docs/#security, ABS uses the variable REFRESH_TOKEN_EXPIRY to control how long a session is valid in the ABS mobile client. As of 2.31.0, this is 2592000 seconds or 30 days. It would be helpful if, on a first app access of the day, the following occurs: - Five days to one day before session expiration: A pop-up occurs within the app giving the user to option to revalidate their login now or postpone until tomorrow - Day of token expiration: The user is redirected to the server screen to revalidate their login. ### Why would this be helpful? Yesterday afternoon, I was driving around and lost access to the ABS controls. The audiobook kept on playing, but I could not pause or stop playback, nor could I see the status as the login screen appeared with a message about token expiration. Thank goodness this occurred while I was in a parking lot waiting to pick up dinner, but if I was driving, I would had to find a safe place to pull over. (Note: Fixing a login issue is NOT a good reason to pull into the emergency lane). With Authentik integrated as a SSO provider plus using 1Password as my password manager, this isn't a simple relogin process on mobile. ### Future Implementation (Screenshot) I think that it would be good if the user is prompted to revalidate their credentials a few days prior to the token expiration, and as part of the first login on the application for the day. As an example: - Starting 5 days prior to the expiration: The user sees a pop-up with the message "Your credentials will be expiring on Sunday, February 1st." with the button to either "Revalidate now" or "Postpone until tomorrow". - Day of token expiration: The user receives a pop-up message "Your credentials have expired." with the button to revalidate now. The five day setting should be controlled from the ABS server with a setting to change it from a one-day notice up to a nine-day notice. ### Audiobookshelf App Version Android App - 0.11.0 ### Current Implementation (Screenshot) No screenshot, but how about some log files? [Log Files.zip](https://github.com/user-attachments/files/24915333/Log.Files.zip)

adam added the enhancement label 2026-04-24 23:57:34 +02:00

adam commented

2026-04-24 23:57:35 +02:00

@nichwall commented on GitHub (Jan 28, 2026):

As mentioned in https://github.com/advplyr/audiobookshelf-app/issues/1787, the refresh token is updated every time the access token is generated again. If the user is able to see that the refresh token has expired that day, the new refresh token is already generated and they don't need to sign in again

If their refresh token has expired, they will just be presented with the login screen because they no longer have access.

@nichwall commented on GitHub (Jan 28, 2026): As mentioned in https://github.com/advplyr/audiobookshelf-app/issues/1787, the refresh token is updated every time the access token is generated again. If the user is able to see that the refresh token has expired that day, the new refresh token is already generated and they don't need to sign in again If their refresh token has expired, they will just be presented with the login screen because they no longer have access.

adam commented

2026-04-24 23:57:36 +02:00

@DieselTech commented on GitHub (Jan 28, 2026):

IMO none of this should be user facing. The refresh token should be continuously sent in the background, constantly pushing the users valid auth login period into the future. JWT's should be refresh every 10-20 minutes while running the app.

@DieselTech commented on GitHub (Jan 28, 2026): IMO none of this should be user facing. The refresh token should be continuously sent in the background, constantly pushing the users valid auth login period into the future. JWT's should be refresh every 10-20 minutes while running the app.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/audiobookshelf-app#1338