Refresh Token
A long-lived credential used to obtain new access tokens without requiring the user to re-authenticate.
What is Refresh Token?
Refresh Token is a credential issued alongside an access token that can be used to obtain a new access token when the current one expires. Refresh tokens typically have longer lifetimes (days, weeks, or months) compared to access tokens (15-60 minutes).
Key characteristics:
- Long-lived: Days to months (unlike short-lived access tokens)
- Single-use or rotating: Can be one-time use (rotating) or reusable
- Broader scope: Can obtain access tokens with any scope the user granted
- Stored securely: Typically in httpOnly cookies or secure server-side storage
When an access token expires, the application uses the refresh token to get a new one without asking the user to log in again.
Analogy
Think of a refresh token like a hotel key card that automatically gets refreshed at the front desk when it's about to expire. You don't have to go to the front desk yourself - it happens automatically in the background to keep your room accessible.
Types and Use Cases
- Mobile Apps: Use refresh tokens to maintain long-lived sessions (days/weeks)
- SPAs: Use refresh tokens with silent renewal to avoid re-login prompts
- Offline Access: Apps can refresh access tokens even when user is not present
- CIAM: Enable 'Remember me' functionality with 30-day refresh tokens
How it Works
// Initial Token Response (Access + Refresh Token)
{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "def502003d8a9f3c2e1b4d5e6f7a8b9c0d1e2f3",
"scope": "openid profile email"
}
// Refreshing Access Token
POST /oauth/token
Content-Type: application/x-www-form-urlencoded
grant_type=refresh_token&
refresh_token=def502003d8a9f3c2e1b4d5e6f7a8b9c0d1e2f3&
client_id=1234567890&
client_secret=client_secret_here
// Response: New Access Token
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"expires_in": 3600
}Refresh Token vs Access Token
Refresh Token
Access Token
Refresh Token is long-lived (days/months) and used to get new access tokens
Access Token is short-lived (15-60 min) and used to access resources
Refresh tokens have broader privileges (can get any scope)
Access tokens have limited scope (only granted permissions)
Refresh tokens are sent only to token endpoint
Access tokens are sent with every API request
Best Practices for Refresh Token
- Use rotating refresh tokens: Issue new refresh token with each use - if stolen, old one becomes invalid
- Store securely: Use httpOnly cookies (not localStorage) to prevent XSS theft
- Detect reuse: If a refresh token is reused, revoke all tokens for that user (indicates theft)
How LoginRadius Powers Refresh Token
LoginRadius CIAM platform provides comprehensive refresh token management with configurable lifetimes (1 day to 1 year), rotating refresh tokens for enhanced security, and instant revocation APIs. Our platform supports silent token renewal for SPAs, refresh token rotation to detect theft, and detailed refresh token usage analytics. LoginRadius also provides 'remember me' functionality using refresh tokens for seamless long-lived sessions.
FAQs
If a refresh token is stolen: (1) Attacker can get new access tokens until refresh token expires or is revoked, (2) Use rotating refresh tokens - issue new refresh token with each use, (3) Detect reuse - if a refresh token is used twice, revoke all tokens (indicates theft), (4) Monitor usage - detect impossible travel, bulk API calls.
Yes, refresh tokens should have an expiration (7-30 days typical). This limits the blast radius if stolen. For high-security scenarios, use shorter refresh token lifetimes (1-7 days) or one-time use (rotating refresh tokens). Never use non-expiring refresh tokens.
LoginRadius provides configurable refresh token management: (1) Configurable lifetime - set expiration from 1 day to 1 year, (2) Rotating refresh tokens - issue new refresh token with each use for enhanced security, (3) Refresh token revocation - instantly revoke all tokens for a user, (4) Silent renewal - SPAs can silently refresh tokens without user interaction, (5) Refresh token APIs - programmatically manage refresh tokens.