Token refreshing & validity

Automatic token refreshCopy Anchor Link

Tenklo automatically refreshes OAuth access tokens before they expire. You don't need to implement any refresh logic in your application.

To prevent token revocation due to inactivity (some APIs revoke unused refresh tokens), Tenklo refreshes each access token at least once every 24 hours.

Handling refresh failuresCopy Anchor Link

Token refresh can fail for various reasons:

• The user revoked access in the external application
• The external API revoked the refresh token
• The external API experienced an outage

When a refresh fails, Tenklo can notify your app via webhook so you can prompt the user to reconnect.

Tenklo automatically retries failed refreshes on its periodic cycle, so a single failure doesn't necessarily mean the connection is broken — transient provider outages often resolve on the next retry. When a connection recovers, Tenklo sends a follow-up webhook with "success": true so you know it's healthy again without having to poll the connection. Tenklo only gives up on a connection (and stops retrying) after several consecutive days of failed refreshes.

Best practicesCopy Anchor Link

Revoked access tokens and refresh failures happen to all integrations. To handle them gracefully:

1. Monitor for failures and recoveries: Set up webhooks from Tenklo to receive notifications when token refresh fails, and again if/when it later recovers
2. Handle revoked tokens: Follow our guide on handling revoked access tokens
3. Implement re-authorization: Make sure you have the re-authorization flow in place so users can easily reconnect broken connections

Related guidesCopy Anchor Link

• Auth guide - implement reconnect sessions for invalid credentials.
• Webhooks from Tenklo - receive refresh failure and recovery notifications.
• Common issues - troubleshoot revoked tokens.