Access tokens are deliberately short-lived, so a stolen one is useful only briefly. A refresh token is the counterpart that lives longer: the client keeps it, never sends it to resource servers, and presents it to the authorization server alone when it needs a fresh access token.
When an API answers 401 because the access token expired — or just before it would — the client POSTs grant_type=refresh_token to the token endpoint and receives a new access token, often with a new refresh token that replaces the old one (rotation). Reusing a rotated refresh token is a signal of theft, and well-designed servers then revoke the whole chain.
That refreshing on every 401 is correct. A 401 caused by a revoked or invalid token will fail again after a refresh; a client that refreshes and retries without a limit turns a logout into an infinite loop. Refresh once, retry once, and send the user to log in if that fails.
POST /auth/v1/oauth/token issues a refresh token in the authorization code flow and accepts grantType refresh_token with that refreshToken to get a new access token. Access tokens here expire after 15 seconds, so the refresh path is reached quickly.
All glossary terms · Testing techniques · All 39 mock REST APIs
Last updated