# Refresh token policy
## Settings
Application > Settings > Refresh Token Rotation: ON.
- Rotation: every refresh invalidates the old token and issues a new pair.
- Reuse Interval: small leeway (seconds) for concurrent requests. Keep it tight; it is not a grace period for replays.
- Absolute Lifetime: hard cap from first issuance (e.g. 30 days). The backstop.
- Inactivity Lifetime: expiry after idle (e.g. 7 days).
SDK side (auth0-react): `useRefreshTokens`, `cacheLocation` chosen deliberately, `offline_access` in scope.
## Client contract
1. Persist the new refresh token BEFORE first use.
2. Single-flight refreshes across tabs.
3. On `invalid_grant`: clear everything, fresh login. No retries.
## Why rotation over long access tokens
A 30-day access token cannot be revoked per-token and lives in every log it touched. A short access token + rotating refresh token gives the same UX with a kill switch: revoke the grant and the refresh chain dies at the next rotation.
## When not to use
Regular web apps: server sessions are the session; refresh tokens add little. M2M: no refresh tokens at all. Native apps: rotation on, same as SPA.
## Checklist
- The four numbers (rotation, reuse interval, absolute, inactivity) written down and reviewed yearly.
- invalid_grant path tested, not just the happy path.