title: OAuth 2.0 Token and Lifetime
body: <p>I am trying to understand OAuth 2.0(<strong>SERVER SIDE FLOW</strong>). Lets take simple example of Google contacts API.</p>
  
  <p>As per specifications, I have registered my app with Google and have got Client ID and Client secret.Also i have mentioned callback URL.</p>
  
  <p>Getting access token requires me to do </p>
  
  <ol>
  <li><p>Redirect user to a certain URL with required query strings and headers as mentioned in OAuth document on Google site (<a href="https://accounts.google.com/o/oauth2/auth" rel="noreferrer">https://accounts.google.com/o/oauth2/auth</a> bla bla stuff)</p></li>
  <li><p>After user enter their credentials, they are sent back to callback URL as mentioned in my APP which i have already registered with google. here querystring parameter &amp;code=4/P7q7W91a-oMsCeLvIaQm6bTrgtp6 bla bla is also appended to call back URL. Thus now have got authorization code</p></li>
  <li><p>Now, i send a request to <a href="https://accounts.google.com/o/oauth2/token" rel="noreferrer">https://accounts.google.com/o/oauth2/token</a> with authorization code i got in previous step so that i get access token and refresh token.</p></li>
  </ol>
  
  <p>Once i have got this "access token" , i can access (say contact API and get user contacts)</p>
  
  <p>Everything is fine upto this point. I also understand that access tokens have limited lifetime and we can get new access token using "refresh token". </p>
  
  <p>A.As a developer, is it my responsibility to store and check if the "access token" is valid?</p>
  
  <p>B. If my website is a public website with "Login with Google/FB/twitter" account, how do i know that its the same user who has returned back to site after 2 days and i dont need him to ask for login, instead user should be auto-logged in to site ? cauz i dont want him to go through the authorization process as they have already given permission to my app. </p>
  
  <p>E.G : I have logged into TechCrunch website using my FB login and can comment on articles. Now even after 1 week if i visit to TechCrunch , i dont have to login again. how do they know that its me and i am already authenticated ?</p>