I am experiencing automatic PAT (Personal Access Token) revocations. A newly (manual) generated PAT used exclusively for plain HTTPS REST calls (GET /v1/devices/{id}/status) is automatically deleted from the SmartThings web console after exactly 24 hours.
No 3rd-party services or OAuth apps are connected to the account.
Is there an enforced 24-hour TTL on manually generated PATs, or is this an account security flag?
Can I do something to avoid this revoke?
With the exception of those created before the end of 2024, PATs expire after 24 hours. I am little surprised that you could discover and create PATs without realising that. It is the first sentence on the tokens page for me.
If you only require Location access the most effective replacement is probably to use renewable OAuth tokens (as described here, there are more polished guides available now).
The gotcha is that it rather appears that approach will require a subscription from later in the year.
If you do need User level access you are pretty much stuck with the PATs as User level OAuth seems to only be by special arrangement. It wouldn’t be so bad if their creation could be automated.
Thank you very much for your reply.
It isn’t what I’d like, but this is the confirm of my annoying problem.
Obviously, when I’ll buy something, Samsung will not be the primary choise.
Regards