# When does a refresh token become invalid?

**URL:** <https://community.auth0.com/t/when-does-a-refresh-token-become-invalid/85811>\
**Category:** Get Help\
**Tags:** refresh-tokens, authentication, auth0\
**Created:** [June 23, 2022, 3:04pm UTC](https://community.auth0.com/t/when-does-a-refresh-token-become-invalid/85811 "2022-06-23T15:04:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kenichi.sugiyama.re](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kenichi.sugiyama.re/32/38332_2.png) [@kenichi.sugiyama.re](https://community.auth0.com/u/kenichi.sugiyama.re)\
**Post date:** [June 23, 2022, 3:04pm UTC](https://community.auth0.com/t/when-does-a-refresh-token-become-invalid/85811/1 "2022-06-23T15:04:51Z")

</div>

Hello!!  
I’m Ken, the native iOS app engineer.

We are using refresh tokens to obtain access tokens with Auth0.

We want to change the refresh token setting from a method using “Absolute Lifetime and Inactivity Lifetime” to a method using “only Inactivity Lifetime”:

Before:

・Refresh Token Rotation  
enabled

・Refresh Token Expiration  
・Absolute Expiration  
ON (31536000 s)

・Inactivity Expiration  
ON (31535999 s)

↓↓

After:

・Refresh Token Rotation  
disabled

・Refresh Token Expiration  
・Absolute Expiration  
OFF (31536000 s)

・Inactivity Expiration（no change）  
ON (31535999 s)

I have a few questions.

1. Aftter applying new setting, would the refreshToken currently used by users be invalid?

2. If so, I assume that all of the app users need to re-authenticate when they have to refresh access tokens. Are there any solutions to avoid this problem?

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\
**Post date:** [June 24, 2022, 1:41pm UTC](https://community.auth0.com/t/when-does-a-refresh-token-become-invalid/85811/3 "2022-06-24T13:41:39Z")

</div>

Hi @kenichi.sugiyama.re

Disabling refresh token rotation is NOT recommended. This is for security. If a refresh token is somehow leaked and used, the refresh token rotation will prevent additional compromise. If you turn off refresh token rotation, and an attacker gets a refresh token, they have a lifetime supply of access tokens.

And if you turn on rotation, you cannot disable the absolute expiration.

I do not think that changing the settings invalidates the current refresh tokens or sessions, but I haven’t tested that.

I’d just set the absolute expiration to the maximum time (1 year maybe?)

John

---

<div class="post-metadata">

**Author:** ![kenichi.sugiyama.re](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kenichi.sugiyama.re/32/38332_2.png) [@kenichi.sugiyama.re](https://community.auth0.com/u/kenichi.sugiyama.re)\
**Post date:** [June 27, 2022, 8:47am UTC](https://community.auth0.com/t/when-does-a-refresh-token-become-invalid/85811/4 "2022-06-27T08:47:41Z")

</div>

Hi @john.gateley

Thanks for your response.

Although I understand that disabling refresh token is not recommended,  
our team give priority to the seamless user experience in our app (use only Inactivity Expiration).

> [@john.gateley](#):
>
> I do not think that changing the settings invalidates the current refresh tokens or sessions, but I haven’t tested that.

Thanks, please let me know if you have additional info.

Sincerely,

Ken

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [July 12, 2022, 8:47am UTC](https://community.auth0.com/t/when-does-a-refresh-token-become-invalid/85811/5 "2022-07-12T08:47:50Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.