Access tokens in the major social APIs last between one hour and 60 days. Reddit bearer tokens expire after 1 hour and Snapchat's after 3600 seconds. X gives 2 hours without the offline.access scope, TikTok 24 hours, Pinterest 30 days, and Instagram, Threads and LinkedIn 60 days. A Facebook Page token obtained from a long-lived user token has no expiry date. Every value below was read from the platform's own documentation on 18 October 2026.
The harder question is what happens when a token runs out. Instagram and Threads refresh a 60-day token in place, but only once it is 24 hours old and before it expires. LinkedIn gives most apps no refresh at all, so the member re-authorizes. Google refresh tokens stop working for six listed reasons. Those rules decide whether a connected account stays connected without the user.
How long does each platform's access token last?
Documented lifetimes run from 1 hour on Reddit to 60 days on Instagram, Threads and LinkedIn, as read from each platform's developer documentation on 18 October 2026.
Linear scale, so the 1-hour and 2-hour bars are short by design: read the printed values. X is 2 hours without offline.access. Facebook Page tokens (no expiry date) and Bluesky (under 30 minutes) are in the table below.
Source: Platform developer documentation, checked 18 October 2026
The table gives the refresh rules and the error each platform returns on expiry. "Not stated" means the official page read for that cell gives no value, and none was filled in.
| Platform | Access token | Refresh token | How you renew | What expiry looks like |
|---|---|---|---|---|
| Instagram (Instagram Login) | Short-lived token from the code exchange, long-lived token valid 60 days (expires_in 5183944) | None. The long-lived token itself is refreshed | GET https://graph.instagram.com/refresh_access_token with grant_type=ig_refresh_token, token at least 24 hours old, unexpired, instagram_business_basic granted | Tokens not refreshed in 60 days "will expire and can no longer be refreshed" (Meta, Instagram business login) |
| Facebook (user token) | Short-lived "in hours", long-lived "about 60 days" (expires_in 5183944) | None | Exchange the short-lived token for a long-lived one. An expired token cannot be exchanged, so the user logs in again (Meta, long-lived tokens) | Error code 190, "The access token has expired", with subcodes 458, 460, 463, 467 (Meta, error handling) |
| Facebook (Page token) | No expiry date when obtained from a long-lived user token | None | Call /{app-scoped-user-id}/accounts with the long-lived user token. The person needs a role on the Page (Meta, long-lived tokens) | Page tokens "only expire or are invalidated under certain conditions" (Meta, long-lived tokens) |
| Instagram (Facebook Login) | Not stated on the getting-started page | Not stated | Not stated | Not stated. See the Meta error codes above |
| Threads | Short-lived 1 hour, long-lived 60 days | None | refresh_access_token, token at least 24 hours old, unexpired, threads_basic granted. A refreshed token is valid for 60 days from the refresh (Meta, Threads long-lived tokens) | Tokens not refreshed in 60 days "will expire and can no longer be refreshed" (Meta, Threads long-lived tokens) |
| WhatsApp (Cloud API) | User tokens "expire quickly", regenerate "every few hours". System user token: expiry preference chosen when you generate it, no figure given | None stated | Generate a new token in Business Settings | Not stated on the page (Meta, WhatsApp access tokens) |
| LinkedIn (default apps) | 60 days (expires_in 5184000) | None for most apps | Send the member through the authorization flow again. The consent screen is skipped if they are still logged in and the token has not expired (Microsoft Learn, LinkedIn authorization code flow) | HTTP 401, with the documented cases "Expired access token" and "The token has been revoked" (Microsoft Learn, LinkedIn error handling) |
| LinkedIn (MDP partners) | 60 days | 365 days, fixed, not extended by use | grant_type=refresh_token at /oauth/v2/accessToken | HTTP 400 invalid_request, "The provided authorization grant or refresh token is invalid, expired or revoked" (Microsoft Learn, programmatic refresh tokens) |
| X (Twitter) | 2 hours unless offline.access is requested | Issued only if offline.access was requested | POST https://api.x.com/2/oauth2/token with the refresh token (X Developer Platform, OAuth 2.0 docs) | Not stated on the pages read |
| TikTok | 24 hours (expires_in 86400) | 365 days (refresh_expires_in 31536000) | Refresh at the token endpoint. The returned refresh_token "may be different" from the one you sent (TikTok for Developers) | Not documented on the page read. Its only error example is invalid_request |
| YouTube and Google | Short-lived. The docs sample shows expires_in 3920 | Valid until revoked or expired, see the conditions below | Refresh grant at https://oauth2.googleapis.com/token | invalid_grant on refresh (Google, OAuth 2.0 guides) |
| Google Business Profile | Uses the same Google OAuth 2.0 flow as YouTube. The Business Profile OAuth overview states no lifetime | Same as Google | Same as Google | Same as Google |
30 days (expires_in 2592000) | 60 days, continuous: refreshable indefinitely | POST /v5/oauth/token, grant_type=refresh_token. The response carries a new access token and a new refresh token with refresh_token_expires_at (Pinterest, authentication docs) | Once the refresh token expires the user must authorize again | |
| 1 hour ("All bearer tokens expire after 1 hour") | Only with duration=permanent. Never for app-only tokens | Refresh with the same HTTP Basic credentials used to get the refresh token (Reddit, OAuth2 wiki) | Not stated on the page | |
| Snapchat (Marketing API) | 3600 seconds | Long-lived, duration not stated | grant_type=refresh_token with client ID and secret | HTTP 401, error="invalid_token", error_description="The access token expired" (Snap, Marketing API authentication) |
| Bluesky (AT Protocol OAuth) | Under 30 minutes, 15 minutes maximum if the server cannot revoke individual tokens, 5 recommended | Spec: public clients 2 weeks, confidential clients 180 days. Single-use, the new refresh token replaces the old one (AT Protocol OAuth spec) | Refresh grant | Not stated on the pages read |
Telegram and Zalo are not in the table. The Telegram Bot API page says each bot gets a unique token and that BotFather can generate a new one, but it says nothing about expiry. The Zalo Official Account docs did not load a readable page on the day of the check.
What do platforms mean by "refresh"?
The same word means four different things across this table. Meta refreshes the access token itself: there is no separate refresh token on Instagram or Threads, so you present a living long-lived token and get a new one with a fresh 60-day clock. LinkedIn, X, TikTok, Pinterest and Google use a refresh token that is a separate credential.
LinkedIn's ordinary apps use neither, and the member goes back through the consent flow. Bluesky OAuth adds a fourth variant where the refresh token is consumed on use.
Lifetimes are not guaranteed either. Meta's access-token guide says "Do not depend on these lifetimes remaining the same" and that they "may change without warning or expire early" (Meta, long-lived tokens, accessed 18 October 2026). A client that reads expires_in from every response survives a change that a client with 60 days hard-coded does not.
The lifetime is the easy half. The refresh rule decides whether an account stays connected without the user.
Which traps do the platform docs confirm?
Six documented rules decide whether a token survives: refresh windows, password changes, Google revocation conditions, rotating refresh tokens, X's offline.access scope and LinkedIn's refusal to issue long-lived tokens. Each is confirmed in the platform's own docs on 18 October 2026.
Meta tokens must be refreshed before they die, and not before they are a day old
For Instagram and Threads the refresh window has a floor and a ceiling: the token must be at least 24 hours old and must not have expired. Meta states that "Tokens that have not been refreshed in 60 days will expire and can no longer be refreshed" (Instagram, Threads, accessed 18 October 2026). A refresh job that runs every 50 days works. One that skips a cycle past day 60 loses the account, and the user has to reconnect.
Facebook user tokens fail the other way, on inactivity. The guide says "If no requests are made, the token will expire after about 60 days" and that an expired token cannot be exchanged for a long-lived one. That sentence is why an idle connected account dies quietly.
A password change invalidates tokens on Facebook and Google
Meta's error handling guide lists code 190 with subcode 460 (Password Changed): the person must log in to the app again. Google's OAuth guide says a refresh token containing Gmail scopes stops working when the user changes their password. Neither page makes this a rule for every scope, so test the scopes you use before you rely on it.
Google refresh tokens die for reasons you do not control
The Google OAuth 2.0 guide (accessed 18 October 2026) lists six conditions under which a refresh token stops working:
- the user revokes your app's access
- the token has not been used for six months
- the user changed their password and the token has Gmail scopes
- the account has more than 100 refresh tokens for your OAuth client ID (creating a new one past the cap invalidates the oldest)
- the consent screen is in Testing status with an external user type, where the refresh token expires in 7 days
- a session control policy expires, in which case calls fail with
invalid_grantand anerror_subtypesuch asinvalid_rapt
The 100-token cap bites developers who run the consent flow repeatedly while testing: every reconnect quietly kills an older token.
Rotating refresh tokens need a store that updates on every refresh
TikTok says the refresh token returned by a refresh "may be different than the one passed in the payload" and that you should replace the old one (TikTok for Developers). Pinterest returns a new continuous refresh token on every refresh. Bluesky OAuth refresh tokens are "generally single-use, with the 'new' refresh token replacing that used in the token request" (AT Protocol). If you store only the first refresh token you receive, the connection dies on the second renewal.
X returns no refresh token unless you ask
X issues an access token that "will only stay valid for two hours unless you've used the offline.access scope", and without the scope "we will not generate a refresh token" (X Developer Platform). An app that forgot the scope has no way to renew without the user.
LinkedIn withholds long-lived tokens on purpose
The LinkedIn authorization guide says "To protect members' data, LinkedIn does not generate long-lived access tokens." If the scopes you request change, "all the previous access tokens are invalidated". LinkedIn also reserves the right to revoke refresh tokens or access tokens at any time and expects your product to fall back to the standard login flow (programmatic refresh tokens).
Which tokens need a scheduled refresh?
Put the short-lived platforms (TikTok, X, Reddit, Snapchat, Google) on refresh-on-demand: renew when a call fails with the documented expiry error or when expires_in runs low. Put Instagram and Threads on a calendar job that fires between day 1 and day 59. Treat LinkedIn default apps as an expiry you notify the user about 60 days out, because no code of yours can renew it.
The rate limits post covers the other reason calls fail with a 4xx on these platforms. On SocialAPI.ai an account's status is active, reconnect_recommended or token_expired, and reconnecting keeps the account's ID (account status docs). The platform pages list what each connector supports.
Questions developers ask about token lifetimes
- How long does an Instagram access token last?
- 60 days for a long-lived token with Instagram Login (
expires_in5183944 seconds). You can refresh it withgrant_type=ig_refresh_tokenonce it is 24 hours old and before it expires, which gives a new 60-day token. A token not refreshed in 60 days expires and can no longer be refreshed, so the user must reconnect (Meta, accessed 18 October 2026). - Do Facebook Page tokens expire?
- A Page token obtained from a long-lived user token has no expiry date. Meta says Page tokens only expire or are invalidated under certain conditions, so a password change or a revoked permission can still end one. Facebook user tokens last about 60 days (Meta, accessed 18 October 2026).
- How long does a TikTok access token last?
- 24 hours (
expires_in86400). The refresh token lasts 365 days (refresh_expires_in31536000), and the refresh response may return a different refresh token, so replace the stored one each time (TikTok for Developers, accessed 18 October 2026). - Why does my X token stop working after 2 hours?
- X access tokens stay valid for two hours unless the
offline.accessscope was requested. Without that scope X does not generate a refresh token, so the user has to authorize again. Requestoffline.accessin the first authorization (X Developer Platform, accessed 18 October 2026). - Can a LinkedIn access token be refreshed?
- Only for approved Marketing Developer Platform partners, who get a 365-day refresh token. Default apps get a 60-day access token and no refresh: the member goes through the authorization flow again (Microsoft Learn, accessed 18 October 2026).
Every platform claim above traces to the pages below, each fetched on 18 October 2026. Meta, Instagram API with Instagram Login, business login (long-lived tokens), Meta, Facebook Login long-lived access tokens, Meta, Graph API error handling (code 190, subcodes), Meta, Instagram API with Facebook Login, get started, Meta, Threads long-lived tokens, Meta, WhatsApp Business access tokens, Microsoft Learn, LinkedIn 3-legged OAuth flow, Microsoft Learn, LinkedIn API error handling, Microsoft Learn, LinkedIn programmatic refresh tokens, X Developer Platform, OAuth 2.0 authorization code flow with PKCE, X Developer Platform, OAuth 2.0 user access token, TikTok for Developers, manage user access tokens, Google, OAuth 2.0 for web server applications, Google, OAuth 2.0 overview, Google, Business Profile OAuth overview, Pinterest, set up authentication and authorization, Reddit, OAuth2 wiki (reddit-archive), Snap, Marketing API authentication, AT Protocol, OAuth specification, AT Protocol, OAuth improvements, Telegram, Bot API, authorizing your bot, Telegram, bot features (BotFather), SocialAPI.ai, connect accounts guide