From cf30bf0df588a1dd5ff911ef4e401a63b9e6c111 Mon Sep 17 00:00:00 2001
From: Victor Parpoil <vparpoil@gmail.com>
Date: Mon, 30 Mar 2026 14:24:13 +0200
Subject: [PATCH] fix: acces token post response expires_in field wasn't
 sending an integer

moved `accessTokenExpiresAt` to `expires_at` and added `expires_in` which is the lifetime in seconds of the access token
as per RFC 6749
---
 lib/oauth.js | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/oauth.js b/lib/oauth.js
index 28c49cf..34d3f4a 100644
--- a/lib/oauth.js
+++ b/lib/oauth.js
@@ -470,6 +470,14 @@ const initRoutes = (self, {
 
       try {
         const token = await self.oauth.token(request, response)
+        let expires_in;
+        if (token.accessTokenExpiresAt != null) {
+            const expiresAtMs = new Date(token.accessTokenExpiresAt).getTime()
+            if (!Number.isNaN(expiresAtMs)) {
+                // RFC 6749 §4.2.2 / §5.1: expires_in is lifetime in seconds from response time
+                expires_in = Math.max(0, Math.floor((expiresAtMs - Date.now()) / 1000))
+            }
+        }
         res
           .set({
             'Content-Type': 'application/json',
@@ -480,7 +488,8 @@ const initRoutes = (self, {
           .json({
             access_token: token.accessToken,
             token_type: 'bearer',
-            expires_in: token.accessTokenExpiresAt,
+            expires_in: expires_in,
+            expires_at: token.accessTokenExpiresAt,
             refresh_token: token.refreshToken
           })
       } catch (err) {