Skip to main content

Token lifecycle

Cache and renew​

Access tokens last 5 minutes (expires_in: 300). There is no refresh token.

  1. Request a token and cache it with its expiry time.
  2. Reuse it for every API call until about 30 seconds before it expires.
  3. Then sign a new assertion and request a new token.

Do not request a token per API call. It adds latency and counts against your limits.

If an API call returns 401, discard the cached token, request a new one and retry once.

What a token can do​

A token carries your partner ID and the scopes you were granted. The gateway checks the issuer, audience, signature, expiry and scopes on every request. It allows 30 seconds of clock skew.

Suspension​

Ryno can suspend your API access. A suspended client cannot obtain new tokens. A token already issued stays usable until it expires, which is at most 5 minutes.

Certificate rotation​

A registered certificate cannot be replaced from the Partner Portal. To rotate:

  1. Generate a new key and certificate.
  2. Contact Ryno support to request the rotation.
  3. Switch your token client to the new private key when Ryno confirms the change.

Track the certificate's end date, shown as Certificate expires on the API Credentials page, and start a rotation well before it.