Some integrations run on a server without anyone using them, for example, a nightly sync between BIMcollab and another system. This article explains how these integrations can stay connected without asking a user to sign in again every few weeks.
Why users normally need to sign in again
BIMcollab only supports the authorization code flow. A user always signs in because the data your application can access depends on that user's type, projects, and project roles.
After sign-in, your application receives a refresh token. A standard refresh token stays valid for 15 days, and each use extends it, up to a maximum of 30 days. After 30 days, a user must sign in again. Find more details in Authorization for the BIMcollab API
For a server application, signing in through a browser every month isn't practical.
Non-expiring refresh tokens
For server-to-server integrations, BIMcollab can provide a non-expiring refresh token. After the user signs in for the first time:
The refresh token no longer changes.
It stays valid for 5 years, and each use extends it.
There is no maximum lifetime.
Your application can use it to request new access tokens without another sign-in.
Who can request it?
You can request a non-expiring refresh token when:
Your application runs on a server.
Your application only connects to a fixed set of BIMcollab spaces.
Your integration works correctly on the Playground. See Developing on the Playground.
Choose the right user account
Your application sees exactly the data that the signed-in user can see. If your integration needs all the data in a space, the user account must be an active member of all projects in that space.
💡 Tip: Use a dedicated account for the integration, instead of a personal account. This way, the integration keeps working when a colleague leaves the company or changes roles.
How to request a non-expiring refresh token
Send an email to [email protected] and include:
A short description of your server application.
The BIMcollab spaces your application connects to.
Your Client ID. If you don't have client credentials yet, see Request client credentials.