Refresh token
A refresh token is a credential a client presents to an authorization server to obtain a new access token without repeating the user authorization process.
Spring in Action, Sixth Edition
A refresh token is a credential that a client presents to an authorization server to obtain a new access token after the current one expires.
- How it is used
- Renews access to a protected API after an access token expires.
- How deep it goes
- Shows client registration, a token response, and a renewal request; does not develop refresh-token internals.
- Examples
- Uses a registered admin client, a five-minute access token, protected ingredient requests, and a curl renewal command.
- What you can do after
- Operate/configure it by enabling the refresh-token grant and requesting a new access token with curl after expiry.
Read how Spring in Action, Sixth Edition explains refresh token →
Software Security for Developers
A refresh token is a credential that a client presents to an authorization server to obtain a new access token without repeating the user authorization interaction.
- How it is used
- Maintains user sessions without repeated login prompts while limiting the exposure of short-lived access tokens.
- How deep it goes
- Explains registration, paired token issuance, renewal, and protection practices, but does not detail the token-exchange request mechanics.
- Examples
- Uses an ACME shopping session, token-endpoint responses, a five-minute expiry, and exercises about purpose, lifetime, and protection.
- What you can do after
- Operate session renewal by registering clients, handling refresh-token responses, and applying storage, rotation, expiration, and revocation safeguards.
Read how Software Security for Developers explains refresh token →
ASP.NET Core in Action, 3e
A refresh token is a credential that allows a client to obtain a new access token after the current access token expires without requiring the user to authenticate again.
- How it is used
- Supports continued API access after short-lived bearer tokens expire.
- How deep it goes
- Defines the exchange and security risk, but does not descend into implementation code.
- Examples
- Uses a five-minute access-token lifetime to illustrate renewal without another user login.
- What you can do after
- Apply it via OAuth or OpenID Connect to renew access without repeatedly authenticating the user.
Read how ASP.NET Core in Action, 3e explains refresh token →
Related concepts
- API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
- clientused by · A client is a person, organization, device, or software component that receives or uses a product, service, resource, or functionality provided by another entity.
- scopeconfigured by · Scope is a defined boundary specifying which entities, activities, resources, or conditions are included or governed in a particular context.
- Proof Key for Code Exchangeaddressed by · Proof Key for Code Exchange (PKCE) is an OAuth security extension in which a client proves possession of a per-request secret when exchanging an authorization code.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.