Refresh token rotation for SPAs: offline_access, rotation, and reuse detection

Not specified by the original author.

TL;DR: Rotating refresh tokens give SPAs long sessions without third-party cookies, but the client must replace the stored token on every rotation and treat reuse detection as a full logout. Set Reuse Interval if you need a small leeway for concurrent requests (a few seconds), but keep it tight.

Refresh token rotation

How it works

With rotation on, each refresh request returns a new access token AND a new refresh token; the old refresh token is invalidated immediately. If a rotated-out token is ever used again, Auth0 treats it as token theft: the whole grant (all tokens) is revoked. That is automatic reuse detection.

Setup

1. Application settings > Refresh Token Rotation: on. Set Reuse Interval if you need a small leeway for concurrent requests (a few seconds), but keep it tight.
2. Absolute Lifetime: the hard cap on the session (e.g. 30 days). Inactivity Lifetime: expiry after idle time (e.g. 7 days). Both count from issuance of the first token in the chain.
3. Request the offline_access scope at login or no refresh token is issued at all. For SPAs this means adding it to authorizationParams scope.

SDK behavior

auth0-react with useRefreshTokens handles the swap: it stores the new refresh token and uses it next time. Rules for your own code:

• Always persist the newest refresh token before using it; a crash between use and persist strands the user.
• Serialize refresh calls: two tabs refreshing at once can trigger false reuse detection. A single-flight lock (leader tab or mutex) avoids it. The reuse leeway setting covers small races.
• On invalid_grant from the token endpoint, assume the grant is revoked: clear stored tokens and send the user to login. Do not retry the same refresh token.

When rotation is wrong

Regular web apps with server sessions usually do not need rotating refresh tokens; the server session is the session. M2M apps do not get refresh tokens at all (client_credentials only).

Checklist

• offline_access requested, rotation on, absolute + inactivity lifetimes set deliberately.
• Reuse detection error path logs the user out cleanly instead of looping.

When to use this

• This covers exactly what the title says: Refresh token rotation for SPAs.
• You are setting this up for the first time, or auditing an existing setup.
• You want the key gotchas in one place before you start.

When not to use this

• You are doing a different workflow with Refresh; these steps are specific to the title above.
• You need the full reference docs; this is the short path, not the manual.

Compatibility

• Not pinned to a specific version; follows current Refresh behavior.

Auth0's refresh token rotation doc describes issuing a new refresh token with each request, invalidating the used one, and automatic reuse detection against replay attacks. The absolute/inactivity lifetime settings are part of the refresh token configuration. Verified against live docs 2026-09-26.