Refresh token
A longer-lived token used only to get a new access token when the old one expires.
Definition
Access tokens are short-lived so a stolen one stops working soon. A refresh token lets the app get a new access token without asking the user to log in again. It must stop working after logout, and with rotation each refresh returns a new refresh token and invalidates the old one.
In practice
After logging out of the banking app, replaying the old POST /auth/refresh request must return 401.
Learn it in context
Lessons that use this term.
Related terms
- Bearer tokenAn access token sent as Authorization: Bearer <token>; whoever holds it is treated as the user.
- JWTJSON Web Token: a signed token with three base64url parts (header, payload, signature) that APIs use to identify the caller.
- SessionThe period during which a user stays logged in without entering their credentials again.