BrowserStack API token expiry impact on active test sessions

Session Continuity During Token Expiry

When a BrowserStack API token expires mid-session, the ongoing test session typically continues to run. This is because authentication is generally validated during the initial handshake when the session is created or the tunnel is established. Once the session is active and running on the remote infrastructure, the platform does not continuously re-validate the API token for every command within that specific session.

Error Differentiation and UI Messaging

Documentation and API responses do not provide a clear distinction between token expiry and other authentication failures:

• API Error Codes: Both expired tokens and insufficient permissions often return a 401 Unauthorized status code. The JSON response body typically lacks a specific sub-code to differentiate an expired token from one that is simply malformed or invalid.
• UI Messaging: The BrowserStack dashboard may display a generic login prompt or an 'invalid credentials' message. It does not explicitly distinguish between an API token expiry, a password expiry, or a lack of specific role-based permissions.

Default Expiry Intervals

There is no documented default expiry interval for API keys across standard BrowserStack plans. API keys are considered persistent until they:

• Are manually rotated via the dashboard or API.
• Are deleted by an administrator.
• The user account is deactivated or its permissions are changed.

Verification Steps for Automation

If you are concerned about token rotation impacting your pipeline, follow these steps to verify environment behavior:

1. Start a long-running automated test (e.g., a script with a long wait time).
2. While the test is active, navigate to the BrowserStack dashboard and rotate the API key used.
3. Monitor the test logs; if the test completes successfully, the session is decoupled from the token's lifecycle.

Note: To provide a more specific recommendation, please clarify if you are using the BrowserStack SDK or direct REST API calls for session management.