What is a refresh token and how is it used?

Question

ICSM Computer · Answer

A refresh token is a special token used in OAuth 2.0 and OpenID Connect that allows a client application to obtain a new access token without requiring the user to log in again. Why Refresh Tokens? Access tokens expire (e.g., in 1 hour) for security reasons.Instead of asking the user to authenticate again, the app uses a refresh token to get a new access token silently.This improves UX and security. Structure Refresh tokens are usually long, random strings (sometimes JWTs).Stored securely by the client.Never sent to resource APIs (only to the token endpoint). Typical Flow with Refresh Token User logs in using the Authorization Code flow. Server returns:After 1 hour (when access token expires): Client sends: Server responds with a new access token (and optionally new refresh token). Security Best Practices Rule Description Store securely Save refresh tokens in a secure place (e.g., encrypted DB) Use HTTPS Always send refresh tokens over HTTPS Rotate refresh tokens Send a new refresh token each time you use it Revoke on logout Clear it on logout or server-side token revocation Scope-limited Refresh tokens should be scoped and client-bound When Not to Use For public clients (SPAs, JS in browser), refresh tokens can be risky unless you use PKCE and Refresh Token Rotation. Example (C# using IdentityModel library) Summary Feature Description Purpose Get new access token without re-authenticating Lifetime Longer than access token (hours, days, or more) Security Must be stored securely; often issued only to trusted apps Common With Authorization Code Flow, OpenID Connect

Rule	Description
Store securely	Save refresh tokens in a secure place (e.g., encrypted DB)
Use HTTPS	Always send refresh tokens over HTTPS
Rotate refresh tokens	Send a new refresh token each time you use it
Revoke on logout	Clear it on logout or server-side token revocation
Scope-limited	Refresh tokens should be scoped and client-bound

Feature	Description
Purpose	Get new access token without re-authenticating
Lifetime	Longer than access token (hours, days, or more)
Security	Must be stored securely; often issued only to trusted apps
Common With	Authorization Code Flow, OpenID Connect

interview

What is a refresh token and how is it used?

Can you answer this question?

1 Answers

Why Refresh Tokens?

Structure

Typical Flow with Refresh Token

Security Best Practices

When Not to Use

Example (C# using IdentityModel library)

Summary