Tag · 2 articles

Refresh Tokens

Jun 4, 2025 · 4 min read

Understanding Token Revocation and When to Use It

Learn how to implement OAuth 2.0 token revocation (RFC 7009) to immediately invalidate access and refresh tokens on logout, security breaches, or permission changes. Includes curl examples for Keycloak, Auth0, and Okta.

Jun 4, 2025 · 3 min read

How OAuth 2.1 Refresh Tokens Work: Best Practices and Expiry

OAuth 2.1 refresh tokens: rotation on every use, reuse detection to catch stolen tokens, expiry lifetime config, and sender-constrained tokens for API security.