Refresh Token
A longer-lived credential used to obtain new access tokens without re-authenticating the user. Refresh tokens should be one-time-use (rotated on each exchange) and bound to the client. Storing them carelessly is one of the most common identity security failures.
Refresh tokens are the highest-value credential in most OAuth deployments because they mint new access tokens without any user interaction, and stolen ones are what turn a browser compromise into months of access. Rotate on every use and detect reuse of an already-spent token, which is the signal that a copy is circulating. Bind them to the client, and keep them out of local storage in browsers.
See also: access token, token theft, DPoP, OAuth 2.1
Related on Start with Identity
- GlossaryID Token
A JWT issued by an OpenID Connect provider that conveys authentication claims about the user. Unlike access tokens, ID tokens are intended for the client, not f
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- GlossaryJSON Web Token (JWT)
A compact, URL-safe token format with three base64-encoded segments: header, payload, and signature. Defined by RFC 7519. JWTs are the dominant format for ID to
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b