--- title: "Refresh Token — Identity Glossary | IDSync" description: "A refresh token is a long-lived credential issued alongside an access token in OAuth 2.0; the client exchanges it for a new access token (and optionally a…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Refresh Token", "item": "https://idsync.com/glossary/refresh-token" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/refresh-token", "name": "Refresh Token", "alternateName": [ "Refresh Token" ], "description": "A refresh token is a long-lived credential issued alongside an access token in OAuth 2.0; the client exchanges it for a new access token (and optionally a new refresh token) without prompting the user to re-authenticate.", "url": "https://idsync.com/glossary/refresh-token", "inDefinedTermSet": "https://idsync.com/glossary" } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Refresh Token Standards # Refresh Token A refresh token is a long-lived credential issued alongside an access token in OAuth 2.0; the client exchanges it for a new access token (and optionally a new refresh token) without prompting the user to re-authenticate. Last reviewed 3 months ago Key points - Refresh tokens decouple session length from access-token TTL — short access tokens, longer refresh tokens. - MUST be stored securely (httpOnly cookie, secure storage, encrypted DB) — leakage means session takeover. - Refresh token rotation (issue a new RT on every use, invalidate the old one) detects theft (RFC 6749, OAuth 2.0 BCP). - Public clients (SPAs, mobile) require PKCE + refresh token rotation + short RT lifetimes — and many security teams disable RTs in SPAs entirely. - Revocable: the authorization server can invalidate a refresh token to terminate the session. ## What is a refresh token? A **refresh token** is the OAuth 2.0 credential that lets a client get a fresh access token _without_ asking the user to sign in again. It's how "stay signed in for 30 days" works under the hood, and how server-to-server integrations stay connected across token expiries. The pattern: 1. User signs in. The authorization server returns an access token (short, e.g. 15 min) and a refresh token (longer, hours to days). 2. The client uses the access token to call APIs. 3. When the access token expires, the client calls `/token` with `grant_type=refresh_token` and gets a new one. 4. If refresh token rotation is enabled, it also gets a new refresh token; the old one is invalidated. ## Why rotation matters Refresh tokens are long-lived. If one leaks (XSS, stolen device, malicious browser extension, stolen mobile backup) the attacker can keep refreshing forever — unless rotation is on. With rotation: - Each refresh issues a new RT and invalidates the previous one. - If the legitimate client and the attacker both try to use the same RT, the second use is detected as a **refresh token reuse**, and the entire token family is revoked — forcing both parties to re-authenticate. This is mandatory for public clients per the OAuth 2.0 Security BCP. ## Storage - **Confidential web app** — refresh token lives server-side, never reaches the browser. - **Mobile** — secure enclave / Keychain / Android Keystore. - **SPA** — controversial. Best practice: don't use refresh tokens in the browser; use BFF (backend-for-frontend) pattern + httpOnly cookies. If you must, use rotation + short TTLs + DPoP. ## When buyers care - After incidents where stolen tokens enabled persistent access (LastPass, CircleCI, GitHub OAuth app compromise, midnight blizzard). - When evaluating IdPs: do they support refresh token rotation? Configurable RT lifetime? Revocation API? - For B2B integrations: how do you revoke a partner's access cleanly? ## Editorial note If a vendor's docs tell you to "store the refresh token in localStorage," close the tab. That's been a known anti-pattern for years. ## Standards & references - [OAuth 2.0 Security Best Current Practice](https://datatracker.ietf.org/doc/draft-ietf-oauth-security-topics/) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [authorization](/directory/category/authorization)[api security](/directory/category/api-security) ### Related terms [oauth 2](/glossary/oauth-2)[access token](/glossary/access-token)[pkce](/glossary/pkce) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the authorization category. [Explore tools](/directory/category/authorization) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.