OAuth token expiration handling shifts in Glitch 2024 release

Answer first

There is no publicly confirmed change to Glitch OAuth token expiration handling in a 2024 release. Official documentation covers token issuance and scopes but omits the post-expiry lifecycle. Based on available documentation and community reports, Glitch does not perform automatic background refresh for you. The client remains responsible for detecting an expired access token and deciding whether to use a refresh token or re-authenticate.

Confirmed facts vs likely explanation

Confirmed: Token issuance and scopes are documented. Token lifecycle after expiry is not described in official docs. No official changelog confirms a 2024 behavior shift.

Likely, for review: Behavior is consistent with standard OAuth 2.0. When an access token expires, Glitch invalidates that token for protected resources. The platform does not appear to silently refresh it. A refresh token must be used by the client to obtain a new access token. If the refresh token is expired, revoked, or missing, a full authorization code flow is required.

Signals and version considerations

API-only integrations must inspect error responses from protected calls to detect expiry. SDK-based Glitch-hosted apps may surface a token expired event via the SDK, but this is not documented as a guaranteed API signal.

Version-specific guard: Glitch API versions are date-stamped. Token behavior is reported as stable across versions, but refresh token rotation policy is a common source of perceived forced re-logins. Since 2023 reports indicate refresh tokens are single-use, a client must persist the new refresh token returned with each refresh. Failing to do so causes immediate invalidation.

Minimal steps for this case

• Detect access token failure on a protected request and treat it as expiry.
• If a refresh token is stored, attempt a refresh token grant using the token endpoint.
• Persist both the new access token and the new refresh token atomically. Do not reuse the old refresh token.
• If the refresh attempt fails with an invalid grant indication, initiate a full authorization code flow and manual re-login.

Uncertainty remains on exact TTL values, precise error payloads, and whether any 2024 change was made without public note. Defensive handling is recommended: proactive refresh before expected expiry and exponential backoff on token endpoint errors.

One diagnostic detail that would change the recommendation: are you using the official Glitch SDK inside a Glitch-hosted app or a direct API integration from an external service? The signal path and available events differ.