title: IdentityServer MVC Token Expiration
body: <p>I am new to Identity server and a key concept is missing from my understanding.
  I am using the code from the <a href="https://identityserver4.readthedocs.io/en/dev/quickstarts/3_interactive_login.html#creating-an-mvc-client" rel="noreferrer">MVC tutorial</a>.</p>
  
  <p>If I decorate my Home controller with the attribute <code>[Authorize]</code> and visit my website I get redirect to the <code>IdentityServer</code>. I then log in using my username and password. I then use some custom code and authenticate. I get back an AccessToken and I can then access the Home controller.</p>
  
  <p>My client settings is as follows:</p>
  
  <pre><code>  new Client {
                  ClientId = "mvc",
                  ClientName = "MVC Client",
                  AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
                  ClientSecrets = new List&lt;Secret&gt;{new Secret("secret".Sha256())},
                  RequireConsent = false,
                  AccessTokenLifetime = 1,
  
                  // where to redirect to after login
                  RedirectUris = new List&lt;string&gt;{"http://localhost:5002/signin-oidc"},
  
                  // where to redirect to after logout
                  PostLogoutRedirectUris = new List&lt;string&gt;{"http://localhost:5002"},
  
                  AllowedScopes = new List&lt;string&gt;
                  {
                      StandardScopes.OpenId.Name,
                      StandardScopes.Profile.Name,
                      StandardScopes.OfflineAccess.Name,
                  }
              }
  </code></pre>
  
  <p>My access token is</p>
  
  <pre><code>{
    "nbf": 1474697839,
    "exp": 1474697840,
    "iss": "http://localhost:5000",
    "aud": "http://localhost:5000/resources",
    "client_id": "mvc",
    "scope": [
      "openid",
      "profile"
    ],
    "sub": "26296",
    "auth_time": 1474697838,
    "idp": "local",
    "amr": [
      "pwd"
    ]
  }
  </code></pre>
  
  <p>As I set my <code>AccessTokenLifetime</code> to 1 my token when sent to call an API etc will be invalided. I still however will be able to access the website.</p>
  
  <p>What is the best way to get the MVC website to confirm that my token has not expired? This may be where the refresh tokens come in to play.</p>
  
  <p><strong>Note</strong>
  The <code>AccessTokenLifetime</code> set to 1 is for testing only so I can test things quickly.</p>