A refresh token is a credential that a client presents to an authorization server to obtain a new access token without asking the user to authenticate again. It balances security and convenience: access tokens expire after a short period, while refresh tokens keep sessions smooth. section 13.2 section 13.6
A typical refresh-token arrangement works as follows:
- Register the client with the authorization server to receive refresh tokens. section 13.2
- Receive an access token and refresh token after the initial authorization-code flow, with or without PKCE. section 13.2
- Use the refresh token to request a new access token after the short-lived access token expires. section 13.2
- Protect refresh tokens by storing them securely, rotating them after use, setting expiration times, and revoking them after suspicious activity. section 13.5
A token response with renewal support
A response from the token endpoint can include an access token, a refresh token, its scope, bearer type, and a five-minute expiration. The client can later exchange the refresh token for a new access token instead of prompting the user to log in again. section 13.2
Figure 13.4 The refresh-token flow. When a client is registered to use refresh tokens, it receives both an access token and a refresh token from the authorization server. The client can use the refresh token to seamlessly request a new access token without requiring additional user interaction. This approach maintains security while providing a smooth, uninterrupted user experience.
Trace the refresh-token flow from client registration and initial token issuance to obtaining a replacement access token without additional user interaction. section 13.2
