The token is indeed updated automatically when it is requested. I was rather wondering if there was a way to not have to request it prior to each AJAX request. Currently, since the application does not know when the token expires, it has to either get it prior to each AJAX request, or try to use a possibly stale token and request it again when it gets a 401 from the REST service. It would be nice to get information about token expiry together with the token in response to k_query_bearer_token request.