Key takeaways
- Instagram through Meta’s Unified Login: a business-integration system-user token with no expiry and no refresh.
- LinkedIn: 60-day access tokens; refresh tokens for approved partners last 365 days on a fixed deadline.
- X: 2-hour access tokens, renewed with a refresh token when the offline.access scope is granted.
- Pinterest: continuous refresh tokens must be refreshed within 60 days; TikTok refresh tokens rotate on every refresh.
- Telegram bot tokens never expire; they change only when regenerated in BotFather.
On this page
How long do access tokens last on each platform?
The access token is what an app sends with each request; the refresh token, where there is one, gets a new access token without asking the person to sign in again. A connection breaks when the refresh fails or the grant is revoked.
| Platform | Access token | How it is renewed | Revoke through the API |
|---|---|---|---|
| Instagram (Unified Login) | No expiry | Not needed; ends if access is revoked | Per permission only |
| Facebook (user login) | 1 to 2 hours, exchanged for about 60 days | Exchange again; Meta says it may expire early | Per permission only |
| Threads | About 60 days (long-lived) | Refresh the long-lived token | Per permission only |
| 60 days | Refresh token for approved partners, 365 days fixed | No self-serve endpoint found | |
| TikTok | 24 hours | Refresh token, 365 days, rotates on every refresh | Yes |
| YouTube and Google Business Profile | About 1 hour | Google refresh token; can lapse (see below) | Yes |
| X | 2 hours | Refresh token with the offline.access scope | Yes |
| Set in each token response | Continuous refresh token, refresh within 60 days | Not covered here | |
| Bluesky (app password) | Short-lived session | Session refresh; no fixed lifetime documented | Revoke the app password |
| Telegram (bot) | No expiry | Not needed | Regenerate in BotFather only |
Does an Instagram access token expire?
Not when Instagram is connected through Meta’s Instagram API with Unified Login: the app receives a business-integration system-user token that has no expiry and needs no refresh, and it stops working only if access is revoked, for example when the app is removed from the business portfolio. Older setups differ: a Facebook user login gives a short-lived token exchanged for a long-lived one of about 60 days, which Meta says may change without warning or expire early. See Instagram without a Facebook Page for the setups Meta documents.
Which tokens have fixed deadlines or rotate?
LinkedIn access tokens last a fixed 60 days (expires_in 5,184,000 seconds). Its programmatic refresh tokens, for approved partners, last 365 days from the original grant, and using them does not move that deadline. TikTok access tokens last 24 hours; its refresh token lasts 365 days and rotates on every refresh, so an app must keep the newest one or lose the connection. Threads issues a long-lived token of about 60 days that the app refreshes.
X access tokens last two hours; with the offline.access scope X also issues a refresh token, used at its token endpoint for a new access token. Pinterest moved to continuous refresh tokens, which must be refreshed within 60 days, and stopped issuing legacy refresh tokens after 25 September 2025.
Why do Google and YouTube refresh tokens stop working?
A Google access token lasts about an hour, and the refresh token can lapse for reasons unrelated to time on the clock: six months without use, more than 100 refresh tokens for one account and client (the oldest is invalidated), or a 7-day limit while the app’s consent screen is in Testing. This applies to YouTube and Google Business Profile alike.
Which tokens never expire?
Telegram bot tokens have no expiry at all. They change only when regenerated through BotFather, which ends the old token at once, and there is no HTTP endpoint to revoke one. Instagram through Unified Login is the other token with no expiry. Bluesky documents no fixed lifetime for an app-password session; revoking the app password in Bluesky’s settings ends it.
What happens in SkedCast when a token expires?
SkedCast renews each token the way its platform allows and shows every connection’s health. When a refresh fails or access is revoked, the connection is marked and a one-click reconnect brings it back; posts that failed meanwhile can be retried. The third-party scheduling support by platform reference covers what each platform lets an app publish, and the API version and sunset tracker the versions behind these tokens.
Sources
FAQ
- Does an Instagram access token expire?
- Not through Meta’s Instagram API with Unified Login, which issues a business-integration system-user token with no expiry; it stops only if access is revoked. A Facebook user login’s long-lived token lasts about 60 days.
- How long does a LinkedIn access token last?
- A fixed 60 days from when it is issued (expires_in 5,184,000 seconds).
- How long does an X access token last?
- Two hours. With the offline.access scope, X also issues a refresh token that gets a new access token without signing in again (checked 5 November 2026).
- Do Telegram bot tokens expire?
- No. They have no expiry and change only when regenerated through BotFather.
- Why would a TikTok connection suddenly fail to refresh?
- TikTok’s refresh token rotates on every refresh; if the newest value was not stored, the next refresh uses an old token and fails.
- Can an app revoke its own access through the API?
- On TikTok, X and Google, yes. Meta allows revoking one permission at a time; LinkedIn has no self-serve endpoint and Telegram none at all.