A refresh token is a long-lived credential that lets an application obtain new access tokens without asking the user to sign in again. It is used in OAuth and OpenID Connect flows to keep a session working after a short-lived access token expires. Because it can extend access, it must be stored, rotated, and revoked carefully.
Refresh Token
What Is a Refresh Token?
A refresh token is a long-lived credential that lets an application obtain a new access token without asking the user to sign in again. In OAuth and OpenID Connect, the app sends it only to the authorization server's token endpoint, not to the resource API. It is not the user's password.
How Refresh Tokens Work
- The user signs in and approves requested access.
- The authorization server issues an access token and, when permitted, a refresh token.
- When the access token expires, the app sends the refresh token to the token endpoint.
- The server validates it and returns a new access token, sometimes with a replacement refresh token.
Access Token vs Refresh Token
Role matters more than format. Either token may be a JWT or an opaque string.
| Feature | Access token | Refresh token |
|---|---|---|
| Purpose | Calls an API | Obtains new access tokens |
| Recipient | Resource API | Authorization server |
| Lifetime | Usually short | Usually longer |
| Storage | Limit exposure | Protect like a password |
Learn more about an access token and the broader meaning of a token.
Benefits of Refresh Tokens
They balance session continuity with shorter-lived API credentials.
- Users avoid repeated sign-ins.
- Expired access tokens can be replaced without re-entering credentials.
- Approved API access can continue under server controls.
Practical Limits and Security Risks
A refresh token can extend access, so compromise is serious.
- It may expire, be revoked, or stop working after logout or withdrawn consent.
- It cannot grant scopes the user or server did not approve.
- Some OAuth clients and flows are not issued refresh tokens.
Refresh Token Security Best Practices
Treat a refresh token like a password.
- Use HTTPS, least-privilege scopes, and secure platform storage.
- Avoid browser-accessible storage where possible, and never log tokens.
- Use rotation and reuse detection when supported.
- Revoke compromised tokens and require sign-in after a failed refresh.
Refresh Tokens in Apps Built With Emergent
When building API-connected products, app design and development should include secure token handling from the start. Emergent can help teams build full-stack workflows that use OAuth integrations while keeping refresh and access-token responsibilities clear. Build secure API integrations with Emergent.
Frequently Asked Questions
Your Questions, Answered
This will automatically populate, don't change
Don't change this element unless you know what you are doing
Why is a refresh token used in OAuth?
It lets an approved app request a new access token after the current one expires, without making the user sign in again.
How do I use a refresh token to get an access token?
The application sends the refresh token to the authorization server's token endpoint using the provider's refresh-token grant requirements. The server returns a new access token if the refresh token is valid.
Does a refresh token expire?
Often, but the rule varies by provider. A token can also become invalid through revocation, logout, password changes, consent withdrawal, or rotation policies.
Where should an application store a refresh token?
Store it in secure server-side or platform-provided protected storage. Avoid exposing it to browser JavaScript where possible, and never place it in logs or source code.
How do I get a refresh token?
Use an OAuth or OpenID Connect flow that supports refresh tokens, request any required offline-access scope, and obtain user authorization. The authorization server decides whether to issue one.
Start Building
on Emergent today
on Emergent today
Start Building
