Refresh token policy for SPAs: rotation on, reuse detection, absolute lifetime

Not specified by the original author.

TL;DR

Application > Settings > Refresh Token Rotation: ON. - Rotation: every refresh invalidates the old token and issues a new pair. - Reuse Interval: small leeway (seconds) for concurrent requests.

Steps

1. Application > Settings > Refresh Token Rotation: ON.
2. - Rotation: every refresh invalidates the old token and issues a new pair.

• Reuse Interval: small leeway (seconds) for concurrent requests. Keep it tight; it is not a grace period for replays.
• Absolute Lifetime: hard cap from first issuance (e.g. 30 days). The backstop.
• Inactivity Lifetime: expiry after idle (e.g. 7 days).

3. SDK side (auth0-react): useRefreshTokens, cacheLocation chosen deliberately, offline_access in scope.
4. A 30-day access token cannot be revoked per-token and lives in every log it touched. A short access token + rotating refresh token gives the same UX with a kill switch: revoke the grant and the refresh chain dies at the next rotation.
5. Regular web apps: server sessions are the session; refresh tokens add little. M2M: no refresh tokens at all. Native apps: rotation on, same as SPA.
6. - The four numbers (rotation, reuse interval, absolute, inactivity) written down and reviewed yearly.

• invalid_grant path tested, not just the happy path.

When to use

You are seeing this: The backstop. - Inactivity Lifetime: expiry after idle (e.g. Use this skill when you run into "Refresh token policy for SPAs: rotation on, reuse detection, absolute lifetime".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

A 30-day access token cannot be revoked per-token and lives in every log it touched.

Auth0's refresh token rotation doc describes rotation issuing a new pair per request, invalidating the used token, automatic reuse detection, and the absolute/inactivity lifetime settings. Verified against live docs 2026-09-26.