Access tokens, refresh tokens and rotation

Authentication and authorization Mid-level Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Order the steps

Order what happens when a stolen refresh token is replayed.

  • The app refreshes with token R1 and receives R2
  • An attacker replays the stolen R1
  • The real user is asked to sign in again
  • The server revokes every token in R1's family

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A B D C

  1. The app refreshes with token R1 and receives R2 R1 is now marked used.
  2. An attacker replays the stolen R1 The server sees a used token.
  3. The server revokes every token in R1's family R2 stops working too.
  4. The real user is asked to sign in again The attacker's access ends.

30-second answer

Short access tokens (minutes) limit the damage if one leaks and need no revocation checks. A long-lived refresh token, sent only to the auth server, gets new access tokens. With rotation, every refresh returns a new refresh token and invalidates the old one; if an old one is ever used again, that signals theft, so the server revokes the whole token family and forces a new login.

Practise saying it · 30 s. No recording, just a timer

Explain refresh rotation.

Say your answer out loud, then check which of these points you covered:

  • Short access tokens
  • Refresh to auth server only
  • Rotate on every use
  • Reuse = theft, revoke family
  • Hash at rest

Deep dive

Store refresh tokens hashed server-side, with family id, expiry and device info.

Bind tokens to the client where possible (DPoP or mTLS sender-constrained tokens).

Absolute lifetimes stop a family from living forever.

Mobile apps keep refresh tokens in the Keychain or Keystore, not plain preferences.

Common mistakes

  • Long-lived access tokens because refresh is 'complicated'.
  • Refresh tokens that never rotate or expire.
  • Ignoring reuse of an old refresh token.

Senior take & follow-ups

Short access, long refresh, rotation with reuse detection, secure storage.

Follow-up questions

Think of your answer first, then open the hint.

  1. What does reuse of a rotated token mean?

    Show hint

    Two parties have it: assume theft and revoke the family.

  2. Why hash refresh tokens at rest?

    Show hint

    A database leak shouldn't hand out working tokens.

Similar on Android: Android Keystore The Android page keeps the refresh token safe on the device; here the server rotates it and detects reuse.

Related questions

Suggest a fix if something here is wrong or out of date.