Token Lifecycle

This page tells how long each sign-in value is valid, how eCourtDate uses the tokens from the identity provider, and how a session ends.

Time Limits

Item	Limit
Agency app sign-in	5 minutes from the start of the sign-in to the return at the Redirect URL. The state is for one use only.
Console sign-in	The state and the nonce stay in the browser session. Each is for one use only.
Agency app token request	The eCourtDate API waits 15 seconds for a response from the Token URL.
ID token time claims in the Console	The Console permits a clock difference of 60 seconds for exp, nbf, and iat.
Agency app session	24 hours.
A change to an IDP profile	The Agency app can use the old settings for up to 15 minutes. The Console uses the new settings at the next sign-in.
Discovery document and signing keys	The Console keeps them for 10 minutes.
IDP Last Sign In panel	The Console shows the most recent Agency app sign-in for 24 hours.

Tokens From the Identity Provider

Token	How eCourtDate uses it
Authorization code	eCourtDate sends it to the Token URL one time. A code is for one use only. A browser refresh or the Back button on the Redirect URL sends a used code.
ID token	eCourtDate reads the claims to find the user, the agencies, and the roles. The Console also verifies the signature, the issuer, the audience, the time, and the nonce. See ID Token Checks in the Console.
Access token	eCourtDate does not use the access token to call the identity provider.

The token lifetime at the identity provider does not change the length of the eCourtDate session. Set the token lifetime at the identity provider to agree with the security policy of the agency.

The eCourtDate Session

Agency app: After a sign-in, eCourtDate gives the user its own session token. The session token is valid for 24 hours. Then the user signs in again from the Sign-in URL. If the session at the identity provider is still active, the identity provider can sign the user in without a password.

Console: After a sign-in, the Console keeps the session in a browser cookie.

When the identity provider disables a user, the user cannot start a new sign-in. A session that started before stays valid until it ends. To remove access at once, remove the user from the agencies in eCourtDate.

Sign-out

Agency app: eCourtDate ends the eCourtDate session. Then it sends the browser to the End Session URL with the client_id and returnTo parameters. The value of returnTo is the Logout URL, https://{region}.ecourtdate.com/logout. The identity provider ends its session. A provider that reads the returnTo parameter then sends the user to the Logout URL.

Console: Sign-out ends the Console session only. The session at the identity provider stays active.

Google does not have an end-session endpoint. For a Google profile, enter the Logout URL of the profile as the End Session URL. See Google Workspace.

Client Secrets

The Client Secret authenticates eCourtDate at the Token URL. eCourtDate sends it to the Token URL only. The sign-in flows send it with HTTP Basic authentication.

When a client secret expires, each sign-in fails at the Token URL. To change the secret:

1. At the identity provider, create a new client secret before the old one expires.
2. Open the IDP profile in the Console.
3. Enter the new value in Client Secret.
4. Click Save changes.
5. Wait 15 minutes. Then test the Sign-in URL and the Console Sign-in URL.
6. At the identity provider, delete the old client secret.

Enter email addresses in Alert Contacts. On the first day of each month, eCourtDate tests the credentials of each profile that has had a sign-in. When the test fails, each contact gets a notice.

PKCE

eCourtDate does not use PKCE (Proof Key for Code Exchange). eCourtDate is a confidential client. It authenticates at the Token URL with the Client ID and the Client Secret. Register the client at the identity provider as a web application. A client type that needs PKCE, such as a single-page application or a native application, does not work with eCourtDate.