Authentication: Expiry tokens > 1 hours and refreshing access_token

[thirdpartyemail]

Hi all, 

1. Is there any way to get an expiry token that is greater than one hour?
2. In order to get an access_token, we need a client_id and client_secret. On authentication, we can allow users to input these and store the resulting access_token. Is there a way we can refresh the access_token without needing to store the user’s Marketo client_id and client_secret?

[SanfordWhiteman · Accepted solution]

There is not.

(You would always need to store the client_id and client_secret anyway, since even systems that use a refresh token don't guarantee you won't need to authenticate again. Unless you're literally giving them access only for one day or something.)