What is Refresh Token?
A refresh token is a long lived credential issued alongside a short lived access token, used solely to obtain a new access token when the old one expires. It is never sent to the resource API. Keeping it separate lets access tokens expire quickly without forcing the user to sign in again each time.
The split exists to reconcile two opposing needs. Access tokens should be short lived so a leak is quickly contained, but repeatedly prompting a person to authenticate would be intolerable. A refresh token, held only by the client and presented only to the authorization server, bridges the gap by minting replacements silently in the background.
Because it is long lived, a refresh token is the more valuable secret. It belongs in encrypted server side storage or the platform secure store, never in browser local storage or a client side bundle. Public clients that cannot keep a secret are expected to use additional protections such as a proof key exchange during the original authorization request.
Refresh token rotation is now the common defense. Each use returns a new refresh token and invalidates the previous one, so presenting a token that has already been redeemed indicates that a copy is circulating. Authorization servers typically respond to that signal by revoking the entire token family, ending both the legitimate and the stolen session.
Refresh tokens also expire, can be revoked by an administrator or by the user withdrawing consent, and are usually invalidated when a password changes. Integrations must therefore treat a refresh failure as an expected event and re-enter the authorization flow rather than retrying indefinitely.
Key points
- Used only to mint new access tokens, never sent to APIs
- Long lived, so it is the more sensitive secret
- Rotation invalidates the previous token on each use
- Reuse of a redeemed token signals theft
- Failure means re-authorize, not retry forever
In practice
An integration stores a refresh token encrypted in its database. Fifty minutes into an hour long access token, a scheduled task presents the refresh token to the authorization server and receives both a fresh access token and a replacement refresh token, saving the new one. Weeks later the user revokes access; the next refresh attempt fails with an invalid grant error, and the integration marks the connection as needing reconnection.