Assuming a setup where a client SPA has a JWT and the API server stores refresh tokens. If a user has a JWT that has expired and they make a request it appears the the norm would be to return a 400 or 401 and have them use some other end-point to refresh the token (e.g. /token/refresh), this would …

Refresh mechanism

Topic		Replies	Views
Solution validation Get Help jwt , spa , refresh-tokens , access-token , flow	2	4110	March 2, 2018
Is this SPA authentication flow secure? Get Help password , authentication , flow	10	6303	March 2, 2018
SPA JWT acting as limited refresh token? Get Help auth0js , spa , refresh , checksession	3	4275	August 28, 2019
Renewal of tokens in a SPA Get Help spa , refresh-tokens , tokens	3	7166	March 2, 2018
Renew access token without reference token Get Help spa , access-token , renew	2	4007	July 25, 2019