Home / Knowledge hub / Refresh token
Knowledge hub
Refresh token
A long-lived token used to get new short-lived access tokens without signing in again.
What it means
A refresh token is a credential an app keeps so it can ask the authorisation server for a new access token when the old one expires. It lets a user stay signed in for days or weeks while the access token itself lives for minutes. The OAuth 2.0 framework defines it in RFC 6749, alongside the access token.
It is only ever sent to the authorisation server, never to the APIs. That split is the point: the token that travels widely is short-lived and low-risk, while the long-lived one is used rarely, travels on one route only, and can be kept under tighter control.
Why it matters
A refresh token is worth more than an access token, because it can be exchanged again and again. Someone who steals one can keep minting fresh access for as long as it stays valid, long after the user closed the tab. Its life span makes it a prized target.
Handling it badly turns short-lived tokens into a permanent door. Expiry settings that look careful on the access token mean little if the refresh token never expires and cannot be revoked. This weakness is behind many cases of long-running account takeover and unexplained sessions.
How it shows up
It lives in mobile apps, single-page apps and server back-ends that call APIs for a user. The current OAuth security guidance, RFC 9700, says refresh tokens for public clients must either be bound to the client or rotated on each use, so a reused old one reveals theft. See OAuth.
The mistakes: a refresh token kept in browser local storage, one that never expires, one that is not revoked when the user logs out or changes their password, rotation with no reuse detection, and tokens that grant wider scope than the original consent. Check storage, lifetime, rotation and what revocation really does.
Questions people ask
Refresh token, answered
How is a refresh token different from an access token?
An access token is presented to an API and is short-lived. A refresh token is presented only to the authorisation server to get a new access token, and lasts longer.
Losing the refresh token is therefore the more serious event.
What is refresh token rotation?
Each time a refresh token is used, the server issues a new one and retires the old. If the old one appears again, that suggests it was copied, and the server can end the whole chain.
RFC 9700 describes this as a defence for public clients.
Where should a refresh token be stored?
On a server, or in the platform's protected storage on a device, such as the keychain. In a browser, avoid local storage, as any script on the page can read it.
A cookie with HttpOnly, Secure and SameSite is usually a safer home.
How long should a refresh token last?
As short as the user experience allows, with an absolute limit as well as an idle limit. Many systems use days or weeks, and require a fresh sign-in after that.
High-risk apps use much shorter lives and ask again for sensitive actions.
How do we test refresh tokens?
Check what happens when a refresh token is used twice, after logout, after a password change, and after being copied to another device. Also look at where it is stored.
A token that still works in those cases is a finding.
Sources
Where this comes from
Related
Terms that sit next to this one
Access token
A short-lived token that lets a client call an API on a user's behalf.
Token revocation
Cancelling a token before it expires, for example after a password change.
OAuth
The standard behind every sign in with and connect your account button.
Token replay
Reusing a stolen or captured token to be accepted as its rightful owner.
JWT expiry
The time claim that stops a signed token from being accepted forever.
Does a copied token keep working?
We test whether long-lived tokens in your app can be reused after logout, a password change or a move to another device, and report what we proved with the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.