title: When should an OAuth authorization code expire?
body: <p>I know that (when using the authorization code &quot;Authorization code&quot; in OAuth), the lifetime of an access-token should be short but the lifetime of a refresh token can be long.
  So I decided for my project:</p>
  <ul>
  <li>access-token-lifetime: 1 day</li>
  <li>refresh-token-lifetime: 30 days</li>
  </ul>
  <p>But what is a typical lifetime of an authorization code?
  Am I right that it should be really, really short?
  Maybe like 1 hour or even only a few minutes?</p>
  <p>I could not find any &quot;best practice&quot; for this..</p>