Simple definition
A refresh token is an OAuth 2.0 token that allows a client to obtain new access tokens without asking the user to enter credentials again every time an access token expires.
Technical definition
It is typically issued by the authorization server after authentication and lives longer than an access token. The client sends it only to the token endpoint to obtain a new access token, and the authorization server may also rotate the refresh token.
How it works / role
A refresh token extends an application session without making the access token itself long-lived. Platforms can revoke, expire, or rotate refresh tokens, and they must be stored securely because theft may allow an attacker to renew access.
What is it used for?
Maintain user or application sessions while keeping access tokens short-lived, which reduces exposure if an access token is leaked.
Practical example
An application receives an access token valid for one hour plus a refresh token. When the access token expires, it calls the token endpoint with the refresh token to obtain a new one.
Common issues
- The refresh token has expired or been revoked
- The token is stored insecurely on the client
- Rotation is mishandled and token reuse is rejected
- Scopes or conditional-access policies prevent renewal
Key takeaway: A refresh token is longer-lived and more sensitive than an access token; protect its storage and correctly handle expiration, revocation, and rotation.