{
  "schemaVersion": 1,
  "capturedAt": "2026-10-11T22:50:18.819Z",
  "toolId": "fp-api-shape-canary",
  "toolVersion": "3.1.0",
  "clientId": "fp-tv-app",
  "requestedScope": "openid offline_access",
  "grantedScope": "openid profile email offline_access",
  "dpopRequired": true,
  "method": "device-login then grant_type=refresh_token with DPoP (4 then 3 successive refreshes)",
  "lifetimes": {
    "expires_in_seconds": 1800,
    "refresh_expires_in_seconds": 7776000,
    "refresh_expires_in_days": 90
  },
  "rotation": {
    "refreshTokenRotatedEveryRefresh": true
  },
  "wallClock": {
    "sliding": true,
    "note": "Each refresh returned full refresh_expires_in=7776000 from that moment; refreshExpiresAt advanced with each refresh."
  },
  "responseKeysObservedOnRefresh": [
    "access_token",
    "expires_in",
    "id_token",
    "not-before-policy",
    "refresh_expires_in",
    "refresh_token",
    "scope",
    "session_state",
    "token_type"
  ],
  "conclusion": {
    "indefiniteRollingRefresh": "YES",
    "caveat": "YES means sliding 90-day offline window: keep refreshing (and retaining DPoP keys) before the window elapses. Missing the window, revoked offline session, or lost DPoP material requires device re-login. Not immortal without activity."
  },
  "publicRealmDocNote": "GET /realms/floatplane does not publish ssoSessionMaxLifespan / offlineSessionMaxLifespan; lifetimes taken from token endpoint responses only."
}