# Refresh token expiry cases **URL:** \ **Category:** Get Help\ **Tags:** refresh-token-rotate, refresh-tokens\ **Created:** [November 4, 2021, 5:45am UTC](https://community.auth0.com/t/refresh-token-expiry-cases/72601 "2021-11-04T05:45:39Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![mukhamed.khasanza](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mukhamed.khasanza/32/26213_2.png) [@mukhamed.khasanza](https://community.auth0.com/u/mukhamed.khasanza)\ **Post date:** [November 4, 2021, 5:45am UTC](https://community.auth0.com/t/refresh-token-expiry-cases/72601/1 "2021-11-04T05:45:39Z")
I want to clarify some specific cases, on how the refresh token behaves. Application settings: The access token is valid for 24 hours. Token rotation is enabled. Leeway is set to 10 seconds. Absolute lifetime is set to 9 days. Inactivity time is set to 8 days. 1. When the user logs in from that moment the absolute lifetime is considered to be the starting point, and if during the application using the user refreshes to access\_token using the refresh token (token rotation is enabled) and the access\_token is valid for 24 hours, so normally the user gets a new refresh token every day, does the absolute token lifetime extend at this point or does it stay as when the user first logged in. 2. If there are multiple devices using the same credentials to log in to the application are they considered completely isolated or do they still share the same absolute lifetime for the refresh token depending on which device logged in first? Can it also be that one of the users logged out manually or due to refresh token expiration, the other device (which was logged in with the same credentials) be anyhow affected as well? 3. We have leeway time set to 10 seconds, but does the token have a number of usage limits, like if the same one will be used 100 times within 10 seconds, will it still be valid? 4. If the same refresh token was used 3 times within the leeway time to refresh a token each returning a new refresh token, as I understood any of those 3 new refresh tokens can be used to renew a token, but when you use the first token which gives a new refresh token, the other two will become invalid and only the new token from the first renewal can be used for further renewals? ---
**Author:** ![SaqibHussain](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/saqibhussain/32/42924_2.png) [@SaqibHussain](https://community.auth0.com/u/SaqibHussain)\ **Post date:** [November 17, 2021, 3:16pm UTC](https://community.auth0.com/t/refresh-token-expiry-cases/72601/2 "2021-11-17T15:16:49Z")
Hi Mukhamed, Welcome to Auth0 Community! I will try and answer your questions below: 1. A user may authenticate and start the clock running on the absolute lifetime setting. In the interim period a user may gain new refresh tokens via rotation and access tokens when they expire. The absolute lifetime will not reset at any point, when the absolute lifetime comes to an end the end user will need to re-authenticate. 2. I believe the same user logging into two devices onto the same app will both have their own token absolute lifetimes i.e. they are not shared. 3. I have not seen any evidence of usage instructions therefore I would expect the scenario to be valid. 4. In the leeway window only the previous token can be used. If the second to last token for example is used then breach detection will trigger. More info on this can be found here [Configure Refresh Token Rotation](https://auth0.com/docs/security/tokens/refresh-tokens/configure-refresh-token-rotation) Many thanks ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [November 17, 2021, 3:37pm UTC](https://community.auth0.com/t/refresh-token-expiry-cases/72601/3 "2021-11-17T15:37:16Z")
Thanks for contributing to community and helping on this one Saqib! ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [November 25, 2021, 12:37pm UTC](https://community.auth0.com/t/refresh-token-expiry-cases/72601/4 "2021-11-25T12:37:47Z")