> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Token Duration Per Scope

> Setting token duration individually per scope in Authlete 3.0 for more granular control and customization.

<Info>
  For **Authlete 2.x** documentation, see [2.x version](/v2/configuration-reference/token-lifecycle-policies/token-duration-per-scope).
</Info>

## Overview

In Authlete 3.0, token durations can be configured at the **Service level**, **Client level**, and **Scope level**. Configuring token durations per scope provides fine-grained control, such as issuing shorter-lived tokens for higher-privilege scopes like `write` while allowing longer durations for lower-privilege scopes like `read`.

For more details on configuring token durations statically at the client level, refer to the [Token Duration Per Client documentation](/configuration-reference/tokens-and-claims/token-duration-per-client).

This short article explains how to set token durations for **access tokens** at the **scope level**.

***

## Configuring Token Duration Per Scope

To configure token durations for specific scopes in Authlete 3.0, follow these steps:

1. Log in to the [Authlete Management Console](https://console.authlete.com).
2. Navigate to **Service Settings > Tokens and Claims > Advanced**.
3. Under the **Supported Scopes** section, click the **Add** button.

![](https://storage.googleapis.com/authlete-website/resources/kb/token-duration-per-scope/1.png)

***

4. In the **Add/Edit Supported Scope** dialog:
   * Enter the **Scope Name** (e.g., `read` or `write`).
   * Provide a description for the scope.
5. Scroll to the **Scope Attributes** section.
6. Click **Add** to add a new attribute:
   * Set the **Key** to `access_token.duration`, `refresh_token.duration` or `id_token.duration` depending on the type of token you want to change the duration for.
   * Set the **Value** to the desired token duration in seconds (e.g., `3600` for 1 hour).
7. Click **Add** again at the bottom of the dialog to save the scope attribute.

![](https://storage.googleapis.com/authlete-website/resources/kb/token-duration-per-scope/2.png)

***

## Example

Assume there is a service and two scopes configured within it. The access token durations are set as follows:

| Entity        | Access Token Duration (seconds) |
| ------------- | ------------------------------- |
| Service       | 86,400                          |
| `read` scope  | 3,600                           |
| `write` scope | 600                             |

Under these conditions, Authlete's [/auth/authorization/issue](/api-reference/authorization-endpoint/issue-authorization-response) API responds to implicit grant flow authorization requests based on the scopes provided.

***

### 1. Response to an authorization request with no scopes

```json theme={null}
{
    "type": "authorizationIssueResponse",
    "accessTokenDuration": 86400,
    "responseContent": "https://client.example.org/cb/example.com
        #access_token=xbNhif-bsWOPyRasrEFUFurBSQUHnarjv6sMz8cSDjg
        &token_type=Bearer
        &expires_in=86400
        &scope=",
    ...
}
```

**Explanation**: The access token duration for the service is used since no scopes are provided.

### 2. Response to an authorization request with `read` scope

```json theme={null}
{
    "type": "authorizationIssueResponse",
    "accessTokenDuration": 3600,
    "responseContent": "https://client.example.org/cb/example.com
                        #access_token=8ihMgxhMf-HYBy-O2rYVlMHEQD7WcvFGUhaXfP3YZHs
                        &token_type=Bearer
                        &expires_in=3600
                        &scope=read",
    ...
}
```

**Explanation**: The access token duration for the `read` scope is used.

### 3. Response to an authorization request with `write` scope

```json theme={null}
{
    "type": "authorizationIssueResponse",
    "accessTokenDuration": 600,
    "responseContent": "https://client.example.org/cb/example.com#access_token=lZ4rjCLlwDvgO2wgOaXhDhNGMhpUE_yGi3pyTPcHFyU
    &token_type=Bearer
    &expires_in=600
    &scope=write",
    ...
}
```

**Explanation**: The access token duration for the `write` scope is used.

### 4. Response to an authorization request with `read` and `write` scopes

```json theme={null}
{
    "type": "authorizationIssueResponse",
    "accessTokenDuration": 600,
    "responseContent": "https://client.example.org/cb/example.com
        #access_token=3zQNzTiX5MUxO1Gy0ZFfD7mhn3U1Cg3Q15rhjNob6uc
        &token_type=Bearer
        &expires_in=600
        &scope=read+write",
    ...
}
```

**Explanation**: The access token duration for the write scope is used since it has the shortest duration among the requested scopes.

## See Also

* [How Authlete determines token duration](/v2/configuration-reference/token-lifecycle-policies/how-to-calculate-token-duration).
* [Token Duration Per Client](/configuration-reference/tokens-and-claims/token-duration-per-client)