google oauth2 refresh token limit

3
votes

I'm developing a web application that needs to access 100 or more different Google Calendars using OAuth2. All the calendars are on different accounts with their respective users. I came across this paragraph from Google:

"Note that there are limits on the number of refresh tokens that will be issued; one limit per client/user combination, and another per user across all clients. You should save refresh tokens in long-term storage and continue to use them as long as they remain valid. If your application requests too many refresh tokens, it may run into these limits, in which case older refresh tokens will stop working."

My app, as advised, is using access tokens and then storing the refresh tokens in a database for later use. I am wondering if I will reach a limit to the number of calendars my refresh tokens will work with? Has anyone experienced difficulty before with refresh tokens stop working after a limit is reached. The paragraph mentions two limits but I'm not sure if my app will be affected as each calendar is a different user. I'm not sure what Google means by 'and another per user across all clients' limit?

Anyone with experience or knowledge in this please help.

Thank you in advance.

2
calendaroauth-2.0google-apigoogle-oauth
Possible duplicate of Google API refresh token limit – Prafulla Kumar Sahu

2 Answers

4
votes

Neither of the limits applies to your scenario, so you shouldn't have any problems.

The "one limit per client/user combination" is 25, so you can't obtain more than 25 refresh tokens for any given user. But you only need one, so that's fine.

"per user across all clients" is saying either:-

  1. that a user can only authorize a certain number of projects, but I'm guessing that's a pretty big number.
  2. It's saying there is a limit on how many clients per project are allowed, but again, you only need one.
2
votes

Here is the doc that shows the limit of 25 tokens: https://developers.google.com/identity/protocols/OAuth2