thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Advanced

Refresh Token

Long-lived OAuth credential used to obtain new access tokens without re-prompting the user.

Definition

Refresh tokens let applications maintain sessions while keeping access tokens short-lived. They must be stored securely and can be revoked by the authorization server. Rotation, where each use issues a new refresh token and invalidates the old one, helps detect theft.

Example

A mobile email app silently uses its refresh token to get a new access token every hour.

Exam tip

Revoke refresh tokens when a user is terminated or a device is lost.

Related terms