The 90 day re-authentication: what exactly expires, and can a client see it coming?

UK Developers
1

I run a small read-only integration against my own account. Confidential OAuth client, refreshes on a schedule, no third party involved. I am trying to plan for the 90 day re-authentication and the API documentation does not mention it anywhere, so I would rather pin the behaviour down than guess.

What I have pieced together from threads here, none of it from the docs:

  • Users must re-authenticate every 90 days under SCA.
  • At the boundary the refresh grant keeps working, and it is the data endpoints that begin refusing.
  • The remedy is an in-app re-approval, not a fresh authorization code flow.

If that is right, it is good news and it deserves to be written down somewhere other than a 2019 thread.

Six questions:

  1. Is the 90 day re-consent still in force, and does the clock run from the last in-app approval or from the original authorisation?
  2. At the boundary, does POST /oauth2/token with grant_type=refresh_token still return 200?
  3. Which code do the data endpoints return at that point, forbidden.insufficient_permissions or forbidden.verification_required? Both are in circulation and they appear to describe different situations.
  4. Is there any programmatic signal before the boundary? A consent expiry on /ping/whoami, on /accounts, anywhere. Today a client cannot tell whether it has eighty days left or two, so it cannot warn its user, and the Monzo app sends no notification either. This is the question I most want answered.
  5. Does Refresh permissions under Settings, Manage apps reset the 90 days without a new OAuth flow, and does it apply to every listed app at once or one at a time?
  6. Some third parties show “Ongoing session” with no countdown while developer clients show days remaining. Is that the open banking AISP consent model rather than the developer API?

Happy to test any of this against my own client and post the results here.
Thanks!