A refresh token lets an application obtain a new access token without asking the user to sign in again.
Frequently asked questions
Does a refresh token expire?
Yes, though typically with a much longer lifetime than an access token, and policies can revoke it independently.
What happens if a refresh token is stolen?
An attacker could mint new access tokens until it's revoked, which is why refresh tokens are treated as highly sensitive and often bound to the requesting client (see DPoP).
Was this definition useful?
Feedback goes to the editor who maintains this entry.
.avif)