Cybersecurity glossary
What is a Refresh Token?
Learn what an OAuth refresh token is, how it renews access tokens without re-login, why refresh token theft is severe, and how rotation and binding reduce risk.
Definition
A refresh token is a long-lived OAuth credential issued to a client that can be presented to the authorization server’s token endpoint to obtain new access tokens—without interactively re-authenticating the resource owner each time.
Why refresh tokens exist
Users hate constant re-authentication. APIs hate long-lived bearer access tokens. Refresh tokens bridge that gap: short access tokens for API calls, longer refresh credentials for silent renewal at the authorization server.
That convenience makes refresh tokens among the most sensitive secrets in an OAuth deployment.
Refresh lifecycle
Interactive grant succeeds
Authorization code (or similar) flow issues access token + optional refresh token.
Access token expires
Client stops using the short-lived API credential.
Refresh request
Client calls the token endpoint with the refresh token and client authentication if required.
New tokens issued
Fresh access token returned; with rotation, a new refresh token replaces the old one.
Revoke when done
Logout, risk, or admin actions invalidate refresh tokens server-side.
Risks unique to refresh tokens
Long lifetime
Stolen RTs can mint access tokens for days or months.
Silent renewal
Attackers refresh without user-visible prompts.
Broad scopes
Offline_access grants often include powerful permissions.
Storage exposure
Mobile backups, XSS, and logs are common leak points.
Replay without rotation
A copied RT works indefinitely until expiry if never rotated.
Orphan grants
Users revoke an app in UI but RT remains valid if not enforced.
Controls that matter
| Control | Purpose | Note |
|---|---|---|
| Rotation + reuse detection | Detect stolen RTs | Revoke token family on reuse |
| Sender constraints | Bind refresh to client key | DPoP or mTLS |
| Narrow scopes | Limit minted access | Avoid offline admin scopes |
| Server-side revocation | Logout and offboarding | RFC 7009 endpoints |
Implementation checklist
- Issue refresh tokens only when offline access is truly needed.
- Rotate refresh tokens and treat reuse as compromise.
- Authenticate confidential clients on every refresh request.
- Store RTs in hardened storage; avoid JS-accessible browser storage.
- Revoke refresh tokens on logout, password change, and MFA reset.
- Monitor anomalous refresh geography and volume.
- Prefer sender-constrained refresh for high-risk apps.
- Document RT lifetimes and ensure they align with organizational session policy.
The practical takeaway
A refresh token keeps sessions alive by minting new access tokens. Protect it more carefully than the access token it replaces.
Rotate, bind, revoke, and minimize scopes—because a stolen refresh token is often a quiet, durable account takeover.
Related security terms
Bearer Token
Access tokens refreshed by RTs are often bearer credentials.
Token Revocation
How refresh tokens should be invalidated on logout or compromise.
OAuth Token Theft
Attacks that specifically target refresh and access tokens.
Sender-Constrained Token
Binding techniques that can also protect refresh usage.
OAuth 2.0
Framework that defines refresh token issuance and use.
Frequently asked questions
What is a refresh token in simple terms?
It is a longer-lived credential your app stores to get new short-lived access tokens so you stay signed in without typing your password every hour.
Why not just make access tokens last for weeks?
Short-lived access tokens limit damage if stolen. Refresh tokens enable continuity while keeping API credentials brief—if refresh tokens are protected and rotatable.
What is refresh token rotation?
Each refresh issues a new refresh token and invalidates the previous one. Reuse of an old refresh token signals theft and can trigger family revocation.
Where should browsers store refresh tokens?
Prefer backend-for-frontend or secure HTTP-only cookie patterns over JavaScript-readable storage. SPAs that hold refresh tokens in localStorage are XSS-fragile.
Can refresh tokens be revoked?
Yes. Authorization servers should support revocation and force re-auth on logout, password change, risk events, and admin disablement.
Do all OAuth grants issue refresh tokens?
No. Issuance is optional and policy-driven. Client credentials often skip them; interactive grants may issue them for offline access.
Are refresh tokens bearer tokens?
Often yes, which makes theft powerful. Prefer rotation, binding (DPoP/mTLS), and strict storage controls.
References
Explore authoritative guidance and frameworks related to refresh token.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.