Personal Access Tokens - Expiration

[poxin13]

These tokens should expire just the same as regular client token correct?

I've set this up in AuthServiceProvider for testing:

Passport::tokensExpireIn(Carbon::now()->addMinute());
Passport::refreshTokensExpireIn(Carbon::now()->addMinute());

Yet i'm still authenticated well after that token should have been expired. Carbon is setup correctly, as I can output Carbon::now() directly as 2016-08-18 16:32:07.

I just noticed in the database the expires_at column is being written as: 2116-08-18 16:09:38. Very strange, all personal tokens seem to be adding 100 years.

[elynnaie]

The current docs say

Personal access tokens are always long-lived. Their lifetime is not modified when using the tokensExpireIn or refreshTokensExpireIn methods.

[overtrue]

// app/Providers/AppServiceProvider.php
//...
use Laravel\Passport\Bridge\PersonalAccessGrant;
use League\OAuth2\Server\AuthorizationServer;
//...

class AppServiceProvider extends ServiceProvider
{
    /**
     * Bootstrap any application services.
     */
    public function boot()
    {
        $this->app->get(AuthorizationServer::class)
              ->enableGrantType(new PersonalAccessGrant(), new \DateInterval('P1W'));
    }
   
    //...
}
//...

About \DateInterval parameter:

https://secure.php.net/manual/en/dateinterval.construct.php