I've read this page and I've got a few questions about the validity of access tokens. If you could answer the following that would be great:
"You can generate a maximum of 10 access tokens from a refresh token in a span of 10 minutes." -
Does this mean I can generate an infinite amount of access tokens just as long it is not within a 10 minute period? For example, can I generate a token every 11 minutes?
Or can I generate 10 tokens every 10 minutes and then another 10 tokens the next 10 minutes?
Can an access token be used by multiple people at the same time?
"You can generate a maximum of 20 refresh tokens in a span of 10 minutes per client ID. When you generate the 21st refresh token, the first created refresh token gets deleted." -
Does this mean that if I create 21 refresh tokens in a span of 10 minutes the 1st token will be deleted?
But if I create 20 refresh tokens in 10 minutes and then after 10 minutes if I create a 21st refresh token the first one won't be deleted?
Or there is a hard limit of 21 refresh tokens so that at whatever time I create a 21st refresh token, the first one created will get deleted?
"Refresh tokens do not expire until a user revokes them."
This seems to contradict the statements made in the previous point. I understand they don't expire unless a user revokes them but, functionally speaking, is the same result if a token is revoke or deleted?