# Achieving a Seamless User Experience with Refresh Token Inactivity Lifetimes

**URL:** <https://community.auth0.com/t/achieving-a-seamless-user-experience-with-refresh-token-inactivity-lifetimes/54146>\
**Category:** Blog Discussions\
**Created:** [December 1, 2020, 4:16pm UTC](https://community.auth0.com/t/achieving-a-seamless-user-experience-with-refresh-token-inactivity-lifetimes/54146 "2020-12-01T16:16:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![robertino.calcaterra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/robertino.calcaterra/32/66825_2.png) [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\
**Post date:** [December 1, 2020, 4:16pm UTC](https://community.auth0.com/t/achieving-a-seamless-user-experience-with-refresh-token-inactivity-lifetimes/54146/1 "2020-12-01T16:16:26Z")

</div>

Delight users while providing a secure CIAM solution for accessing applications and services.  
[Read more…](https://auth0.com/blog/achieving-a-seamless-user-experience-with-refresh-token-inactivity-lifetimes/)

Brought for you by @randynasson

 ![Achieving a Seamless User Experience with Refresh Token Inactivity Lifetimes](https://global.discourse-cdn.com/auth0/original/3X/9/a/9a72f7e9a1d260899810d4a4d64a28e762c821b3.jpeg)

---

<div class="post-metadata">

**Author:** ![robertino.calcaterra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/robertino.calcaterra/32/66825_2.png) [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\
**Post date:** [December 1, 2020, 10:45pm UTC](https://community.auth0.com/t/achieving-a-seamless-user-experience-with-refresh-token-inactivity-lifetimes/54146/2 "2020-12-01T22:45:06Z")

</div>

How did you like this post? Please share any comments or feedback with us on this thread!

---

<div class="post-metadata">

**Author:** ![stephanie.chamblee](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/stephanie.chamblee/32/26087_2.png) [@stephanie.chamblee](https://community.auth0.com/u/stephanie.chamblee)\
**Post date:** [February 5, 2021, 2:08pm UTC](https://community.auth0.com/t/achieving-a-seamless-user-experience-with-refresh-token-inactivity-lifetimes/54146/3 "2021-02-05T14:08:18Z")

</div>

This topic was automatically closed 27 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [March 7, 2022, 2:09pm UTC](https://community.auth0.com/t/achieving-a-seamless-user-experience-with-refresh-token-inactivity-lifetimes/54146/4 "2022-03-07T14:09:02Z")

</div>



---

<div class="post-metadata">

**Author:** ![viktorvsk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/viktorvsk/32/47350_2.png) [@viktorvsk](https://community.auth0.com/u/viktorvsk)\
**Post date:** [May 18, 2023, 1:59pm UTC](https://community.auth0.com/t/achieving-a-seamless-user-experience-with-refresh-token-inactivity-lifetimes/54146/5 "2023-05-18T13:59:12Z")

</div>

Its not actually clear what is the difference between Native Apps and SPAs in the context of the article and why is it safer to avoid Refresh Tokens rotation for Native Apps more than for SPAs with only Inactivity Lifetime enabled

---

<div class="post-metadata">

**Author:** ![randynasson](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/randynasson/32/10247_2.png) [@randynasson](https://community.auth0.com/u/randynasson)\
**Post date:** [May 18, 2023, 6:15pm UTC](https://community.auth0.com/t/achieving-a-seamless-user-experience-with-refresh-token-inactivity-lifetimes/54146/6 "2023-05-18T18:15:33Z")

</div>

Hello @viktorvsk. The reason the default for RTR is set to disabled for Native Apps is merely to avoid a change in behavior for customers (adding refresh token rotation) that expect Native Apps to not rotate those tokens. So the only new behavior we introduced here were the default expiration settings. We set the default rotation behavior for SPAs to enabled because previously we did not allow refresh tokens to be used in SPAs, so enabling this by default sets the correct/secure behavior that complies with recommended security best practices.
