RefreshTokens

Refresh tokens are credentials used to obtain new access tokens in OAuth 2.0 and OpenID Connect flows. They are issued by the authorization server alongside an access token after a successful authorization, and are intended to preserve a user session without requiring re-authentication.

When an access token expires, the client can request a new one by sending a request to the token endpoint with grant_type=refresh_token, including the refresh token and client authentication. If valid, the server issues a new access token and often a new refresh token. Some providers implement refresh token rotation, issuing a fresh refresh token and invalidating the previous one; others may reuse the same token until it expires or is revoked.

Security and best practices are central to refresh token use. Because refresh tokens typically have longer lifetimes, safeguarding them is critical. Store them securely (for example, in secure device storage or HttpOnly cookies) and transmit them only over HTTPS. Consider rotating tokens to limit exposure, implementing a revocation endpoint, and monitoring for suspicious activity. Revoke tokens on sign-out or suspected compromise, and apply least-privilege principles to the associated access tokens.

Scope and implementation details vary by provider. Refresh tokens are commonly used with confidential clients and with PKCE for public clients in mobile or native apps. They are not defined by a single standardized flow, but are a common extension across OAuth 2.0 implementations.

Lifecycle considerations include token lifetimes set by policy, with refresh tokens lasting from days to weeks or longer. Changes to user accounts or password resets may invalidate tokens, requiring re-authentication.