Refresh token policy for SPAs: rotation on, reuse detection, absolute lifetime

Not specified by the original author.

Refresh token policy

Settings

Application > Settings > Refresh Token Rotation: ON.

• Rotation: every refresh invalidates the old token and issues a new pair.
• Reuse Interval: small leeway (seconds) for concurrent requests. Keep it tight; it is not a grace period for replays.
• Absolute Lifetime: hard cap from first issuance (e.g. 30 days). The backstop.
• Inactivity Lifetime: expiry after idle (e.g. 7 days).

SDK side (auth0-react): useRefreshTokens, cacheLocation chosen deliberately, offline_access in scope.

Client contract

1. Persist the new refresh token BEFORE first use.
2. Single-flight refreshes across tabs.
3. On invalid_grant: clear everything, fresh login. No retries.

Why rotation over long access tokens

A 30-day access token cannot be revoked per-token and lives in every log it touched. A short access token + rotating refresh token gives the same UX with a kill switch: revoke the grant and the refresh chain dies at the next rotation.

When not to use

Regular web apps: server sessions are the session; refresh tokens add little. M2M: no refresh tokens at all. Native apps: rotation on, same as SPA.

Checklist

• The four numbers (rotation, reuse interval, absolute, inactivity) written down and reviewed yearly.
• invalid_grant path tested, not just the happy path.

Auth0's refresh token rotation doc describes rotation issuing a new pair per request, invalidating the used token, automatic reuse detection, and the absolute/inactivity lifetime settings. Verified against live docs 2026-09-26.