Session token assumed to be expired while being valid

[S0NN1]

OS details

• c8y version: 2.52.3
• OS: macOS 15.7 24G222 arm64
• Host: Mac16,7
• Kernel: 24.6.0
• Shell: zsh 5.9
• Terminal: ghostty
• CPU: Apple M4 Pro

Description

My use case is re-using the same session in different terminals without refreshing the token every time.
If I set a session in one terminal like the following

The token should be valid for 8 hours since its generation.
But if I open a new terminal session within seconds and execute set-session, I get:

[reubenmiller]

Yes this is actually on purpose due to an issue that I've been able to find the root cause of (yet), #365.

By default the threshold is set to 8h (a working day), so if the token doesn't have at least 8 hours before it expires, then a new token is requested.

However, you can control this threshold by using the session.tokenValidFor setting.

Example: Add to your shell profile to change the threshold to 5 mins

eval $(c8y settings update session.tokenValidFor "5m" --shell zsh)

Adjust the --shell <value> to match whatever shell you're using.

[reubenmiller]

Ah I think it is just a misunderstanding that the threshold is calculated (expiresAt - threshold)...not (valideFrom + threshold).

[S0NN1]

Exactly, looking at the script output I would have expected the first session to last 8 hours until ~6 p.m.

[reubenmiller]

No the "tokenValidFor" is not the setting which controls how long the token is valid for, it is more for the client to discard the token if it is "about to expire"...at the moment this "about to expire" value is set to 8 hours which essentially shortens the token validity time by 8 hours.

So from your screenshot:
tokenExpiresAt: 2025-10-07T17:50:03+02:00
minimumValidFor: 8h

So this means if you run set-session after 9:50:03, then go-c8y-cli will ignore the token and request a new one. In your screenshot, you ran "set-session" at 9:51 (1 minute past the threshold), hence why it was ignored.

But you're totally right that this setup is confusing and weird, and I would like to get rid of it altogether, but until I find out why the tokens are being invalidated, we might need to stick with it for now.