Clarification on OAuth Token Expiration Fields (expires_in and expires_at)

Developer Support APIs & Integrations
1

While implementing OAuth, I noticed that the token exchange response includes additional fields that aren’t currently documented, specifically expires_at, might be related to fields that were added in late August.
Is it safe to assume that both fields expires_at and expires_in will always be present and match, so either can be used? Thanks.

2

Hi there @KWari

Thanks for surfacing this — OAuth field behavior can definitely get confusing when the documentation doesn’t fully reflect what the API returns.

I’ll loop in a few of our subject matter experts who may have deeper insights into how expires_in and expires_at are intended to behave.

Hi @Jigar_Thakker @ChristinaKay @HubDoPete , hope you’re all doing well! Have you seen consistent behavior between these two fields? Can developers safely rely on both being present and aligned?

Hopefully we can get some clarity here.
Victor

3

Hi @KWari

You can treat expires_at as optional convenience; if present, you can use it for quick expiration checks but always have a fallback to compute expiration from expires_in. This approach ensures your OAuth flow remains robust even if HubSpot changes its response format.

I hope this will help you out. Please mark it as Solution Accepted and upvote to help another Community member.

Thanks!