Does Android AccountManager automatically refresh expired scoped auth tokens?
0 reputation · 01 Feb 2024, 08:01 UTC
I am designing an Android app that uses AccountManager to obtain an OAuth-style auth token with a narrow scope for a specific account. The goal is to rely on the system for least-privilege credential handling without building custom token storage.
On Android 8.0 (API 26) and later, AccountManager binds returned tokens to the requesting package UID and supports scoped requests. However, documentation does not define a guaranteed token lifetime, and expired tokens reportedly surface as authentication errors rather than triggering automatic refresh. Token expiry appears to depend on the authenticator implementation and can vary by device manufacturer.
Does AccountManager automatically invalidate and replace an expired scoped token when the app requests it again, or must the app call invalidate() and request a new token explicitly? Is the expiration timestamp exposed through AccountManager, or only through the authenticator?