Skip to main content

Token caching — required

Do not request a new token for every API call. Tokens are valid for 8 hours. Request one, cache it, and reuse it until shortly before it expires.

  1. On startup (or first API call), request a token.
  2. Store the token together with its expiry time, calculated from expires_in.
  3. Reuse the cached token for all subsequent API calls.
  4. Refresh when the token is within a short buffer of expiry — for example 5–10 minutes — rather than waiting for it to expire.
  5. If an API call returns 401, request a fresh token and retry once.

Why this matters​

Requesting a token per API call is treated as misuse. It adds unnecessary latency to your own integration and load to the authorization server. Rate limiting may be applied to token requests, and excessive request rates may be raised with you directly.

Warning

Do not implement a retry loop that requests a new token on every failure without a backoff — this can escalate quickly during an incident.