Tokens and credentials
Refresh token
A long-lived credential used to obtain new access tokens without the user re-authenticating.
What Refresh token means
A refresh token exists so that access tokens can be short-lived without asking the user to sign in every few minutes. It is the more valuable of the two and the one worth attacking: an access token expires in minutes, a refresh token may be usable for weeks.
Defined in: RFC 6749 §1.5; rotation and reuse detection in the OAuth 2.0 Security BCP.
How it works
Rotation is the standard defence. Each use returns a new refresh token and invalidates the old one, so a stolen token can be used at most once before the theft becomes detectable.
Detection follows from rotation. If an old refresh token is presented after being rotated, either the legitimate client is replaying or an attacker is using a stolen copy, and neither is benign. The correct response is to invalidate the whole token family and force re-authentication — a real inconvenience, chosen deliberately over leaving a possible compromise running.
For public clients that cannot keep a secret, rotation plus sender-constraining is the current guidance. A refresh token sitting in browser storage with no rotation and no binding is a long-lived credential in the least defensible place available.
The mistake people actually make
Issuing refresh tokens that never rotate and never expire, then discovering during an incident that there is no way to tell which of them are still in the right hands.
Guides that go deeper
- OAuth and OpenID Connect for single-page apps: where tokens should live
- Refresh token rotation and reuse detection, explained
- JWT vs opaque access tokens: which should you use?
- OAuth and OpenID Connect for native and mobile apps
- Token theft and replay: how bearer tokens are stolen and how to limit the damage
Related terms
Access token
A credential presented to an API to prove the caller is authorized, typically short-lived.
DPoP
Demonstrating Proof of Possession — binds a token to a key the client holds, so a stolen token alone is useless.
Session revocation
Ending an active session so that subsequent requests fail, rather than waiting for a token to expire.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.