fix(auth): bump MCP OAuth access token TTL to 7d#4365
Conversation
The `oauthProvider` was using the default `accessTokenExpiresIn` of 1h. For MCP clients that don't request `offline_access` (or whose refresh token storage is flaky), this forces re-auth multiple times a day. Bump to 7d so a refresh hiccup at most loses a week of session, not a single hour. Same approach we took for the CLI in #4069 — but on the server side so it covers all MCP clients, including ones we don't control (Claude Desktop, Cursor, etc). Note: the underlying upstream issue — `@better-auth/oauth-provider` not preserving audience across refresh-token grants per RFC 8707 §2.2 — is still present in 1.6.10 and 1.7.0-beta.3. Worth filing separately.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe OAuth provider configuration in the Better Auth setup is updated to explicitly set access token expiration to 7 days instead of relying on the prior default value. ChangesOAuth Token Expiration Configuration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Greptile SummaryThis PR extends the OAuth access token TTL from the better-auth default of 1 hour to 7 days for the
Confidence Score: 4/5Safe to merge; the change is a one-line config addition with no logic or schema changes. Extending the access token TTL from 1 hour to 7 days is a deliberate security tradeoff: a leaked JWT now stays valid for up to 7 days because the MCP route uses stateless verification and cannot invalidate tokens mid-flight. The PR description acknowledges this explicitly, and 7 days is still well within the 30-day default refresh-token window. No other behavior is altered. Only
|
| Filename | Overview |
|---|---|
| packages/auth/src/server.ts | Adds accessTokenExpiresIn: 60 * 60 * 24 * 7 to oauthProvider config, extending access token TTL from the better-auth default of 1 h to 7 days to reduce forced re-auths for MCP clients that can't use refresh tokens. |
Prompt To Fix All With AI
Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 1
packages/auth/src/server.ts:205
The arithmetic is correct (604 800 s = 7 days), but a named constant or inline comment would make the intended TTL immediately obvious to future readers without mental arithmetic — especially useful if the value is ever revisited.
```suggestion
accessTokenExpiresIn: 60 * 60 * 24 * 7, // 7 days
```
Reviews (1): Last reviewed commit: "fix(auth): bump MCP OAuth access token T..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| consentPage: `${env.NEXT_PUBLIC_WEB_URL}/oauth/consent`, | ||
| allowDynamicClientRegistration: true, | ||
| allowUnauthenticatedClientRegistration: true, | ||
| accessTokenExpiresIn: 60 * 60 * 24 * 7, |
There was a problem hiding this comment.
| accessTokenExpiresIn: 60 * 60 * 24 * 7, | |
| accessTokenExpiresIn: 60 * 60 * 24 * 7, // 7 days |
Prompt To Fix With AI
This is a comment left during a code review.
Path: packages/auth/src/server.ts
Line: 205
Comment:
The arithmetic is correct (604 800 s = 7 days), but a named constant or inline comment would make the intended TTL immediately obvious to future readers without mental arithmetic — especially useful if the value is ever revisited.
```suggestion
accessTokenExpiresIn: 60 * 60 * 24 * 7, // 7 days
```
How can I resolve this? If you propose a fix, please make it concise.Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
🧹 Preview Cleanup CompleteThe following preview resources have been cleaned up:
Thank you for your contribution! 🎉 |
1 participant
Summary
oauthProviderwas using the better-auth defaultaccessTokenExpiresInof 1h. MCP clients that don't requestoffline_access(or whose refresh-token storage flakes) end up re-auth'ing multiple times a day. Set it to 7d.Background
This is the same problem we fixed client-side in #4069 for the Superset CLI ("the 1h access-token TTL plus no refresh path meant the CLI forced re-login multiple times per day"). The CLI fix added
offline_access+ a refresh handler, but for third-party MCP clients (Claude Desktop, Cursor, ChatGPT Connectors, etc.) we can't dictate scopes — we have to make the server tolerant.7d was picked to cover a typical work week so a single refresh hiccup doesn't bounce someone out, while keeping the blast radius of a leaked token finite.
Why not "fix it properly" upstream
Two real issues live in
@better-auth/oauth-providerand are still present in latest (1.6.10) and 1.7.0-beta.3:checkResourcereadsctx.body.resourcefresh on every request — if a client refreshes without sendingresource, the issued token is opaque, and our MCP route only verifies JWTs. Our route → 401 → forced re-auth.deleteMany's every refresh token for that user+client.The MCP TS SDK does pass
resourceon refresh so (1) doesn't bite SDK-using clients today, and (2) is hard to relax without security tradeoffs. Not changing better-auth versions in this PR — pinning 1.6.5 across the board for now.Test plan
oauth_access_tokens.expires_atfor tokens issued before vs. after deploySummary by cubic
Increase MCP OAuth access token TTL from 1 hour to 7 days to prevent frequent re-auth for clients without
offline_accessor flaky refresh storage. Makes the server more tolerant of third‑party MCP clients while keeping risk bounded.accessTokenExpiresInto 7 days in the OAuth provider.@better-auth/oauth-providerrefresh-audience issue remains.Written for commit 679f658. Summary will update on new commits.
Summary by CodeRabbit