Need long-duration get_face_access_token tokens for Azure AI Vision Face API (currently only 7 days) for liveness detection

Question

Need long-duration get_face_access_token tokens for Azure AI Vision Face API (currently only 7 days) for liveness detection

Niket Kumar Singh 600

HelloTeam,

We are using the Azure AI Vision Face API and the Face Client SDK for implementing the liveness detection feature in our production environment. We have followed all the official setup and integration guidance:

Get started with the Azure AI Vision Face UI Web SDK

Accessing Azure AI Vision Face Client SDK Release Artifacts

We are using the get_face_access_token script provided in the repository to generate access tokens that allow us to install the SDK and run the liveness detection flow.

Currently, the tokens are only valid for 7 days.

This change has created challenges:

We have integrated the solution into production, where frequent token renewals are not ideal.
We are concerned about potential service disruptions if the token expires and is not refreshed in time.
We would like to avoid setting up complex automation just to renew tokens every week.
Is there any way to configure or request longer-duration tokens (e.g., 3 or 6 months) specifically for production deployments of liveness detection?
What are Microsoft’s recommendations or best practices for managing tokens in production for liveness detection use cases?
Is this expiration behavior linked to the subscription type (for example, CSP vs. ISV), or is it a universal change across all Azure customers?

We would appreciate any clarification or guidance so we can align our deployment strategy and ensure uninterrupted use of the liveness detection feature in production.

Thank you for your support!

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Niket Kumar Singh 600 Reputation points

2025-05-07T14:50:52.2233333+00:00
Hi Team,

We are currently implementing the Azure AI Vision Face UI Web SDK for liveness detection in our production environment. We are following the official GitHub sample and using the get_face_access_token.ps1 script to generate access tokens as shown here: https://github.com/Azure-Samples/azure-ai-vision-sdk/blob/main/scripts/get_face_access_token.ps1

Observation:

When we generate tokens using this script, the returned tokens have a validity of 7 days.

However, in the documentation for the issueLimitedAccessToken API, it states that tokens can have an expiration time between 60 seconds and 86,400 seconds (24 hours), and no longer. Reference: https://learn.microsoft.com/en-us/azure/ai-services/face/use-limited-access-tokens

Questions for clarification:

Why does the get_face_access_token.ps1 script produce tokens with a 7-day validity, whereas the issueLimitedAccessToken API is limited to 24 hours?

Are these two token mechanisms fundamentally different in how they are managed by the Azure platform (i.e., is one CSP-specific vs. ISV-specific, or SDK-specific)?

As we have moved this solution to production, is it safe and supported by Microsoft to continue relying on these 7-day tokens, or should we prepare for more frequent token refresh cycles?

Is there any official recommendation or upcoming change from Microsoft that will harmonize these two approaches or change the current behavior?

We are eager to align our production setup with Microsoft’s guidance and want to avoid any unexpected disruptions.

Thank you very much for your clarification!
Niket Kumar Singh 600 Reputation points

2025-05-08T05:19:06.3766667+00:00

Hi kothapally Snigdha

Sorry my bad, I got a bit confused between the two tokens. It’s clear now after your explanation.

To summarize and confirm:

The download-access-token (which we generate using the script from the GitHub reference: https://github.com/Azure-Samples/azure-ai-vision-sdk/blob/main/scripts/get_face_access_token.ps1) is used to download the frontend SDK and has a validity of 7 days. We observed this behavior during our testing.

The liveness-session-token is the one used to authorize the frontend SDK to perform liveness checks in real-time. This token has a maximum expiration time of 86,400 seconds (24 hours), and it is used during active liveness checks after integration into the application.

Thank you so much for the clarification and assistance this helps a lot!

Accepted answer

0 additional answers

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Niket Kumar Singh 600 Reputation points

2025-05-07T14:50:52.2233333+00:00

Hi Team,

We are currently implementing the Azure AI Vision Face UI Web SDK for liveness detection in our production environment. We are following the official GitHub sample and using the get_face_access_token.ps1 script to generate access tokens as shown here: https://github.com/Azure-Samples/azure-ai-vision-sdk/blob/main/scripts/get_face_access_token.ps1

Observation:

When we generate tokens using this script, the returned tokens have a validity of 7 days.

However, in the documentation for the issueLimitedAccessToken API, it states that tokens can have an expiration time between 60 seconds and 86,400 seconds (24 hours), and no longer. Reference: https://learn.microsoft.com/en-us/azure/ai-services/face/use-limited-access-tokens

Questions for clarification:

Why does the get_face_access_token.ps1 script produce tokens with a 7-day validity, whereas the issueLimitedAccessToken API is limited to 24 hours?

Are these two token mechanisms fundamentally different in how they are managed by the Azure platform (i.e., is one CSP-specific vs. ISV-specific, or SDK-specific)?

As we have moved this solution to production, is it safe and supported by Microsoft to continue relying on these 7-day tokens, or should we prepare for more frequent token refresh cycles?

Is there any official recommendation or upcoming change from Microsoft that will harmonize these two approaches or change the current behavior?

We are eager to align our production setup with Microsoft’s guidance and want to avoid any unexpected disruptions.

Thank you very much for your clarification!
Niket Kumar Singh 600 Reputation points

2025-05-08T05:19:06.3766667+00:00

Hi kothapally Snigdha

Sorry my bad, I got a bit confused between the two tokens. It’s clear now after your explanation.

To summarize and confirm:

The download-access-token (which we generate using the script from the GitHub reference: https://github.com/Azure-Samples/azure-ai-vision-sdk/blob/main/scripts/get_face_access_token.ps1) is used to download the frontend SDK and has a validity of 7 days. We observed this behavior during our testing.

The liveness-session-token is the one used to authorize the frontend SDK to perform liveness checks in real-time. This token has a maximum expiration time of 86,400 seconds (24 hours), and it is used during active liveness checks after integration into the application.

Thank you so much for the clarification and assistance this helps a lot!

Answer 1

Hi @Niket Kumar Singh

The Azure AI Vision Face API's limited access tokens for liveness detection have a maximum expiration time of 24 hours (86,400 seconds). The expired Time parameter can be set between 60 seconds and 86,400 seconds when issuing tokens via the issue Limited Access Token API. Tokens valid for 7 days or longer (e.g., 3 or 6 months) are not supported.

kindly refer the link Use limited access tokens for Face

Microsoft advises automating token refresh in production to prevent service disruption, as longer-duration tokens are not configurable for production deployments.

This expiration behavior is consistent across Azure customers and is not dependent on subscription type (CSP vs. ISV).

For liveness detection, session authorization tokens expire after 48 hours or sooner if deleted. Thus, session management and timely token renewal are necessary to maintain uninterrupted service

Hope this helps. Do let us know if you any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

kothapally Snigdha 2,500 Reputation points Microsoft External Staff Moderator

2025-05-08T08:32:40.32+00:00

Hi @Niket Kumar Singh

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Share via

Need long-duration get_face_access_token tokens for Azure AI Vision Face API (currently only 7 days) for liveness detection

0 additional answers

Your answer