Skip to main content

Refresh and extend sessions

For certain use cases, sessions need to be refreshed on user activity or administrative action.

When you refresh a session, its expires property is set to a value that is the time when the refresh is triggered plus the amount of time defined by the value of /session/lifespan.

Refresh sessions as administrator​

To extend a session's lifespan, call the administrative adminRefreshSession endpoint with the session ID:

PATCH https://{your-project-slug-here}.projects.oryapis.com/admin/sessions/{id}/refresh
Authorization: Bearer {your-personal-access-token}
tip

To get the Session ID, call the /sessions/whoami endpoint or toSession SDK method.

Reduce database load​

Refreshing sessions causes database writes.

To reduce the database load, you can limit the time in which the session can be refreshed by adjusting the earliest_possible_extend configuration.

For example, if you set earliest_possible_extend to 24h, sessions can't be refreshed sooner than 24 hours before they expire. This setting prevents putting excessive load on the database.

If you need high flexibility when extending sessions, you can set earliest_possible_extend to lifespan, which allows sessions to be refreshed during their entire lifespan, even right after they are created.

danger

If you set earliest_possible_extend to lifespan, all sessions will constantly be refreshed!

ory patch identity-config <your-project-id> \\
  --replace '/session/earliest_possible_extend="24h"'
path/to/kratos/config.yml
session:
  earliest_possible_extend: 24h0m0s