Key takeaways
- Telegram bot tokens never expire by default and have no expiry mechanism at all — they can only be revoked or regenerated manually through the BotFather chat, never via an HTTP endpoint.
- LinkedIn's access tokens carry a fixed 60-day lifespan from the moment of grant, confirmed directly on LinkedIn's documentation — its programmatic refresh tokens (available only to approved partners) last 365 days on a FIXED wall-clock deadline that using the token does not extend.
- TikTok's refresh token rotates on every single refresh call and the app must persist the newest value — reusing an old rotated-out refresh token will fail.
- X's and Bluesky's exact token lifetimes could not be confirmed via a direct primary-source fetch in this research and are flagged accordingly — do not treat the commonly cited numbers for these two as certain without re-verifying against the platforms' own current pages.
Instagram access token expiration: long-lived and fixed-deadline tokens
LinkedIn's access tokens have a confirmed, fixed 60-day lifespan (expires_in: 5184000 seconds). Its programmatic refresh tokens, available only to approved Marketing Developer Platform partners, last 365 days — and that countdown is a fixed wall-clock deadline from the original grant, not extended by using the refresh token, so a token refreshed on day 360 still expires in 5 days regardless of the refresh itself.
Facebook and Instagram issue short-lived tokens (roughly 1-2 hours) that exchange for long-lived tokens lasting about 60 days — Meta's own documentation explicitly caveats that a long-lived token 'may change without warning or expire early,' offering no hard guarantee. Threads runs a similar 60-day long-lived token, but its underlying PERMISSION grant separately expires after 90 days for public profiles (extended by refreshing) — private-profile grants cannot be extended this way at all and require full user re-authorization.
Short-lived and rotating tokens
TikTok's access token lasts 24 hours; its refresh token lasts 365 days AND rotates on every refresh call, meaning the app must persist the newest refresh token each time or lose the ability to refresh again. Google/YouTube's access token lasts roughly 1 hour — refresh tokens there can die silently from 6 months of inactivity, from hitting a 100-refresh-tokens-per-account-per-client-ID cap (creating a new one past that cap silently invalidates the oldest), or from a forced 7-day expiry while the app's OAuth consent screen remains in "Testing" status.
What could not be confirmed, and tokens that never expire
X's and Pinterest's exact token lifetimes rest on search-summary-level sourcing rather than a directly re-fetched primary page in this research and should be spot-checked before being treated as certain. Bluesky's access-token lifetime is similarly unconfirmed and conflicting between sources (one figure of 2 hours vs. vaguer 'a few minutes' language); its refresh token is commonly cited around 90 days, also unconfirmed via a raw fetch.
Telegram is the clean exception at the other extreme: bot tokens never expire by default, with no expiry mechanism at all. They can only be revoked or regenerated through the BotFather chat interface (never an HTTP endpoint), and issuing a new token instantly and permanently invalidates the old one.
Revoking a grant programmatically
Programmatic revoke endpoints are confirmed for TikTok (POST /v2/oauth/revoke/), X (POST https://api.x.com/2/oauth2/revoke), and Google/YouTube (POST https://oauth2.googleapis.com/revoke). Meta only exposes a per-permission revoke (DELETE /{user-id}/permissions/{permission-name}); no full-app-deauthorize-via-API endpoint was found documented. No self-serve programmatic revoke endpoint was found for LinkedIn. Telegram has no HTTP revoke at all — only the BotFather chat flow.
FAQ
- Do Telegram bot tokens expire?
- No — Telegram bot tokens never expire by default and have no expiry mechanism at all. They can only be revoked or regenerated manually through the BotFather chat, never via an HTTP API call.
- How long does a LinkedIn access token last?
- A fixed 60 days from the moment it was issued, confirmed directly on LinkedIn's own documentation (expires_in: 5184000 seconds).
- Does refreshing a token always extend how long the connection lasts?
- Not always — LinkedIn's refresh token countdown is a fixed wall-clock deadline from the original grant that using the token does not extend, so a connection can still expire on schedule even with regular refreshing.
- Why would a TikTok integration suddenly be unable to refresh its token?
- Because TikTok's refresh token rotates on every single refresh call — if the newest rotated value was not persisted after a prior refresh, the next refresh attempt fails using the old, now-invalid token.
- Can an app programmatically revoke its own access to a connected account?
- It depends on the platform — TikTok, X, and Google/YouTube expose a real revoke endpoint; Meta only allows revoking one permission at a time; LinkedIn and Telegram have no confirmed programmatic revoke at all.
- Are all the token lifetimes on this page equally well-confirmed?
- No — LinkedIn's, TikTok's, and Telegram's figures are confirmed directly on primary documentation; X's, Pinterest's, and Bluesky's exact lifetimes rest on weaker, search-summary-level sourcing and are flagged as such rather than stated as certain.