---
'@pdsjs/core': patch
---

An OAuth session of a confidential client lasts up to two years, and ends after
three months without a refresh, as on the reference PDS. It ended two weeks
after its first authorization, however often the client refreshed it. A public
client's session still ends after two weeks.