IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Refresh-token rotation & reuse detection
A refresh token is a long-lived key to an account. If it leaks, rotation turns the thief's copy into an alarm. Your goal: explain how rotation and reuse detection cancel a stolen refresh token.
- A refresh token makes new access tokens, so thieves want it.
- With rotation, each refresh token works only once.
- If a used token comes back, the whole family is canceled.
- A short leeway of seconds allows a safe retry.
Two tokens, two jobs
Every login gives your app two tokens. The access token is the key you show the API on each call. It lasts only minutes. The refresh token lasts much longer. Your app trades it for new access tokens, so Maya does not log in every few minutes. Whoever holds it can keep making access tokens. The tokens lesson has the full tour.
Rotation: a leaked token defeats itself
A rotating refresh token works only once. Each time your app refreshes, the identity provider (IdP) sends a new refresh token. It cancels the old one.
Now add reuse detection. If an old, used token shows up again, the IdP assumes it was stolen. It cancels the whole token family: that token and every token that came after it. Everyone must log in again.
A cheque book where each leaf works only once. Each time you use one, the bank gives you the next. Then someone shows a leaf that was already cashed. The bank freezes the whole account and calls you. The old leaf is a tripwire.
Malware copies Maya's refresh token, RT0. Her app refreshes, and RT0 becomes RT1. Later, the attacker uses the stolen RT0. The IdP sees reuse and cancels the whole family, RT1 too. Maya signs in again. The attacker is locked out.
The leeway window
Networks drop replies. Say your app's refresh works, but the answer is lost, and the app tries again. You do not want the whole login destroyed for that. So many IdPs add a small leeway. For a few seconds, the just-used token may be sent once more, as a safe retry. A replay after the window sets off reuse detection. Keep the leeway tiny: seconds, never minutes. A long leeway lets a thief replay without setting off the alarm.
Rotation shrinks the damage from a leaked refresh token. Pair it with short access-token lifetimes. The next lesson covers an access token that a thief copied and that has not expired.
Go deeper: where the advice comes from
This is advice from RFC 9700. It says refresh tokens for public clients must be sender-constrained or rotated. Rotation is the simpler way, so it is common.
🧪 Interactive lab — enable JavaScript to play with this one.
Check whether your app really cancels tokens at logout with Logout Check.