function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion
SFDC Admin12SFDC Admin12 

Can anyone tell me the sizes of access_token and refresh_token in Microsoft platform and if reasonable, should it be stored in the Data base.

Our app has the need of storing access_token and refresh_token in the DB, but as we compare the size to Salesforce's same tokens - it's much larger: access_token in MS 2150 chars vs access_token in SF 112 chars (similar ratio for refresh tokens). We are using the On-Behalf-Of flow : https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow My understanding is that OAuth2 spec wouldn't specify the size of the tokens, it's open to implementations. The question is if cookie based storage is not preferred, or for cases where custom apps would need to use DB access/refresh token serializations - isn't the length/size an issue or constrain? thanks
Best Answer chosen by SFDC Admin12
AbhishekAbhishek (Salesforce Developers) 
There are no known size limits for AAD tokens.

For further reference, you can check this too,

https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens

Let me know if it helps you and close your query by marking it as solved so that it can help others in the future.

Thanks.