# \#refresh-tokens **URL:** https://community.auth0.com/tag/refresh-tokens/209.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Free/Essentials: safe MCP re-consent after revocation, including in-flight refresh](https://community.auth0.com/t/free-essentials-safe-mcp-re-consent-after-revocation-including-in-flight-refresh/203267)
**Author:** [@mcp-dev-enquiry](https://community.auth0.com/u/mcp-dev-enquiry)\ **Replies:** 1\ **Last updated:** [September 12, 2026, 12:19am UTC](https://community.auth0.com/t/free-essentials-safe-mcp-re-consent-after-revocation-including-in-flight-refresh/203267 "2026-09-12T00:19:56Z")
We are evaluating Auth0 Free and B2C Essentials for a public third-party MCP client using authorization-code PKCE and refresh tokens. Our API immediately records local removal even when the client is disconnected. We nee… --- ## [Token and refresh token sought](https://community.auth0.com/t/token-and-refresh-token-sought/199297)
**Author:** [@jefijefin8](https://community.auth0.com/u/jefijefin8)\ **Replies:** 1\ **Last updated:** [April 30, 2026, 6:22pm UTC](https://community.auth0.com/t/token-and-refresh-token-sought/199297 "2026-04-30T18:22:13Z")
my understanding about token is jwt is only return accesstoken that doesnot contain username ,email such without password ,but refresh token is genarated by jwt or backend my understanding is it is a random string ge… --- ## [Ability to delete least used refresh tokens](https://community.auth0.com/t/ability-to-delete-least-used-refresh-tokens/198284)
**Author:** [@teodor.andrei](https://community.auth0.com/u/teodor.andrei)\ **Replies:** 0\ **Last updated:** [March 23, 2026, 10:13pm UTC](https://community.auth0.com/t/ability-to-delete-least-used-refresh-tokens/198284 "2026-03-23T22:13:51Z")
Currently, the oldest refresh token gets deleted when the user generates the 201st token, which creates a bad user experience (users get logged out of devices they wish to keep authenticated). By allowing a way to delete… --- ## [Token could not be decoded or is missing in DB](https://community.auth0.com/t/token-could-not-be-decoded-or-is-missing-in-db/152070)
**Author:** [@freetechnologiesapp](https://community.auth0.com/u/freetechnologiesapp)\ **Replies:** 4\ **Last updated:** [December 4, 2024, 3:39pm UTC](https://community.auth0.com/t/token-could-not-be-decoded-or-is-missing-in-db/152070 "2024-12-04T15:39:43Z")
Good morning everyone, I am opening this topic because my users are experiencing login issues with my app due to the refresh token exchange. The logs indicate the error mentioned in the topic title, but I can’t fully u… --- ## [How do refresh token works in auth0 angular12 using auth0/auth0-angular?](https://community.auth0.com/t/how-do-refresh-token-works-in-auth0-angular12-using-auth0-auth0-angular/70984)
**Author:** [@ifour.purvi](https://community.auth0.com/u/ifour.purvi)\ **Replies:** 3\ **Last updated:** [March 16, 2024, 12:31am UTC](https://community.auth0.com/t/how-do-refresh-token-works-in-auth0-angular12-using-auth0-auth0-angular/70984 "2024-03-16T00:31:45Z")
Hi, I’m trying to use refreshed token for calling the backend API when existing token gets expired with auth0 in angular12 SPA, But i’m not finding any proper explanation in any documentation. I’ve tried calling getTo… --- ## [The access token expired and a refresh token is not available. The user will need to sign in again. What now?](https://community.auth0.com/t/the-access-token-expired-and-a-refresh-token-is-not-available-the-user-will-need-to-sign-in-again-what-now/89971)
**Author:** [@amg1](https://community.auth0.com/u/amg1)\ **Replies:** 13\ **Last updated:** [January 25, 2024, 9:36am UTC](https://community.auth0.com/t/the-access-token-expired-and-a-refresh-token-is-not-available-the-user-will-need-to-sign-in-again-what-now/89971 "2024-01-25T09:36:46Z")
Hey fellow devs, I got Auth0 going to log my users in and out. However I am currently testing on what happens when the access token expires. Currently I only get this error: I am using nextjs-auth0 ^1.9.1 (with a Ne… --- ## [Keep a React app logged in for more than 24hrs](https://community.auth0.com/t/keep-a-react-app-logged-in-for-more-than-24hrs/71345)
**Author:** [@bunge12](https://community.auth0.com/u/bunge12)\ **Replies:** 2\ **Last updated:** [October 17, 2023, 12:24pm UTC](https://community.auth0.com/t/keep-a-react-app-logged-in-for-more-than-24hrs/71345 "2023-10-17T12:24:19Z")
Hello, auth0 community! I have a React app and users log in using auth0 with a username & password. The React app then connects to a back-end API and uses the access token to verify that the user can access the API. The… --- ## [Oauth/token not returning refresh token](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093)
**Author:** [@kruegeba](https://community.auth0.com/u/kruegeba)\ **Replies:** 9\ **Last updated:** [August 14, 2023, 9:43pm UTC](https://community.auth0.com/t/oauth-token-not-returning-refresh-token/58093 "2023-08-14T21:43:35Z")
I have a 3rd Party application (web application) set up and am currently unable to get the refresh token in my /token call after completing an Authorization Code Flow. I’m kicking it off correctly I believe (indicating … --- ## [Get Refresh Tokens - /authorize "state" parameter](https://community.auth0.com/t/get-refresh-tokens-authorize-state-parameter/85062)
**Author:** [@k.lee](https://community.auth0.com/u/k.lee)\ **Replies:** 1\ **Last updated:** [July 24, 2023, 4:41pm UTC](https://community.auth0.com/t/get-refresh-tokens-authorize-state-parameter/85062 "2023-07-24T16:41:17Z")
I’m trying to implement a flow using auth0/nextjs in which I add the access token in the header of API calls. Currently using getAccessToken method for this. The idea is to call getAccessToken and if it fails (token exp… --- ## [Refresh token implementation](https://community.auth0.com/t/refresh-token-implementation/99767)
**Author:** [@IsoardiMarius](https://community.auth0.com/u/IsoardiMarius)\ **Replies:** 2\ **Last updated:** [February 14, 2023, 10:13am UTC](https://community.auth0.com/t/refresh-token-implementation/99767 "2023-02-14T10:13:42Z")
Hello everyone, I thank you in advance for your patience and for the time you give me. I’ll explain my problem to you, I’d like to set up a refresh token, because currently, when a user logs in, the lifespan of the toke… --- ## [The refresh\_token was generated for a user who doesn't exist anymore](https://community.auth0.com/t/the-refresh-token-was-generated-for-a-user-who-doesnt-exist-anymore/90344)
**Author:** [@sergio.tomas](https://community.auth0.com/u/sergio.tomas)\ **Replies:** 2\ **Last updated:** [February 9, 2023, 1:40pm UTC](https://community.auth0.com/t/the-refresh-token-was-generated-for-a-user-who-doesnt-exist-anymore/90344 "2023-02-09T13:40:07Z")
I’m receiving an error message when I tried to get a refresh token. Message: The refresh\_token was generated for a user who doesn’t exist anymore. But the user is not deleted, not linked with other account and the conn… --- ## [Android force update token](https://community.auth0.com/t/android-force-update-token/92350)
**Author:** [@kotya341](https://community.auth0.com/u/kotya341)\ **Replies:** 1\ **Last updated:** [October 14, 2022, 11:21pm UTC](https://community.auth0.com/t/android-force-update-token/92350 "2022-10-14T23:21:18Z")
I’m working on migration of ipd provider for our android app Please include the following information in your post: we are using android sdk com.auth0.android:auth0 com.auth0.android:auth0:2.8.0 mid sdk version is 26 … --- ## [Find user who is using too many refresh tokens](https://community.auth0.com/t/find-user-who-is-using-too-many-refresh-tokens/91746)
**Author:** [@allanw](https://community.auth0.com/u/allanw)\ **Replies:** 3\ **Last updated:** [October 4, 2022, 10:44pm UTC](https://community.auth0.com/t/find-user-who-is-using-too-many-refresh-tokens/91746 "2022-10-04T22:44:24Z")
We are getting emails about at least one user using too many refresh tokens. How do we find which user is getting too many refresh tokens and what app they are using. --- ## [Failure to revoke refresh token](https://community.auth0.com/t/failure-to-revoke-refresh-token/91210)
**Author:** [@finnbai](https://community.auth0.com/u/finnbai)\ **Replies:** 3\ **Last updated:** [October 3, 2022, 6:39pm UTC](https://community.auth0.com/t/failure-to-revoke-refresh-token/91210 "2022-10-03T18:39:27Z")
Hello, I’m currently using the Angular Auth0 SDK and refresh tokens to be able to give the ability to keep users logged in when a user updates their Auth0 email address. In doing this I ran into issues where the user wa… --- ## [When does getAccessTokenSilently refresh the access token?](https://community.auth0.com/t/when-does-getaccesstokensilently-refresh-the-access-token/90342)
**Author:** [@eywolfe](https://community.auth0.com/u/eywolfe)\ **Replies:** 2\ **Last updated:** [September 12, 2022, 11:11pm UTC](https://community.auth0.com/t/when-does-getaccesstokensilently-refresh-the-access-token/90342 "2022-09-12T23:11:02Z")
Which SDK this is regarding: @auth0/auth0-react SDK Version: 1.10.2 Platform Version: How can I check what version I’m on? I’m using getAccessTokenSilently in a Provider to refresh access tokens in my application, and … --- ## [Unable to revoke refresh tokens](https://community.auth0.com/t/unable-to-revoke-refresh-tokens/89867)
**Author:** [@ViktorWb](https://community.auth0.com/u/ViktorWb)\ **Replies:** 1\ **Last updated:** [September 6, 2022, 10:15pm UTC](https://community.auth0.com/t/unable-to-revoke-refresh-tokens/89867 "2022-09-06T22:15:20Z")
I am trying to follow the guide revoke refresh tokens. My goal is to create a button in my SPA which says “Logout of all sessions”. When pressed, all refresh tokens should be revoked, effectively forcing a user to re-lo… --- ## [Getting unauthorized/access\_denied on getting token using refresh token](https://community.auth0.com/t/getting-unauthorized-access-denied-on-getting-token-using-refresh-token/88378)
**Author:** [@wkjljadlskfjklasjflw](https://community.auth0.com/u/wkjljadlskfjklasjflw)\ **Replies:** 3\ **Last updated:** [August 9, 2022, 11:02pm UTC](https://community.auth0.com/t/getting-unauthorized-access-denied-on-getting-token-using-refresh-token/88378 "2022-08-09T23:02:15Z")
This is a code snippet on my Nextjs project using nextauth to get new tokens followed this thread async function refreshAccessToken(token: any) { try { const url = \`${process.env.AUTH0\_ISSUER}/oauth/token?\` … --- ## [Refresh Token not getting returned in auth0-nodeJS SDK](https://community.auth0.com/t/refresh-token-not-getting-returned-in-auth0-nodejs-sdk/86205)
**Author:** [@matt.kaufman](https://community.auth0.com/u/matt.kaufman)\ **Replies:** 6\ **Last updated:** [July 1, 2022, 8:54pm UTC](https://community.auth0.com/t/refresh-token-not-getting-returned-in-auth0-nodejs-sdk/86205 "2022-07-01T20:54:52Z")
Please include the following information in your post: Which SDK this is regarding: Node-auth0 SDK Version: latest Platform Version: node 16? Code Snippets/Error Messages/Supporting Details/Screenshots: we’re using the… --- ## [When does a refresh token become invalid?](https://community.auth0.com/t/when-does-a-refresh-token-become-invalid/85811)
**Author:** [@kenichi.sugiyama.re](https://community.auth0.com/u/kenichi.sugiyama.re)\ **Replies:** 2\ **Last updated:** [June 27, 2022, 8:47am UTC](https://community.auth0.com/t/when-does-a-refresh-token-become-invalid/85811 "2022-06-27T08:47:41Z")
Hello!! I’m Ken, the native iOS app engineer. We are using refresh tokens to obtain access tokens with Auth0. We want to change the refresh token setting from a method using “Absolute Lifetime and Inactivity Lifetime”… --- ## [Refresh Token Rotation with @auth0/nextjs-auth0 SDK](https://community.auth0.com/t/refresh-token-rotation-with-auth0-nextjs-auth0-sdk/84403)
**Author:** [@sofiyev.external](https://community.auth0.com/u/sofiyev.external)\ **Replies:** 1\ **Last updated:** [June 10, 2022, 4:03pm UTC](https://community.auth0.com/t/refresh-token-rotation-with-auth0-nextjs-auth0-sdk/84403 "2022-06-10T16:03:26Z")
Hello, I’m using @auth0/nextjs-auth0 SDK in my Next.JS application and trying to enable refresh token rotation. I enabled Refresh Token Rotation on the Settings page. (Reuse Interval is 0 second) offline\_access added… --- ## [Update Access Token custom claims with Refresh Token](https://community.auth0.com/t/update-access-token-custom-claims-with-refresh-token/82336)
**Author:** [@hector](https://community.auth0.com/u/hector)\ **Replies:** 5\ **Last updated:** [May 2, 2022, 4:31pm UTC](https://community.auth0.com/t/update-access-token-custom-claims-with-refresh-token/82336 "2022-05-02T16:31:19Z")
Hello! We are using the React Native SDK to handle login, logout and fetching new access tokens using the refresh token. During login we pass a query parameter to the authentication page, which is read by the Login Acti… --- ## [Token\_failed, Failed to get token: \[error: invalid\_grant, description: Unknown or invalid refresh toke](https://community.auth0.com/t/token-failed-failed-to-get-token-error-invalid-grant-description-unknown-or-invalid-refresh-toke/82564)
**Author:** [@ahmed.khouaja](https://community.auth0.com/u/ahmed.khouaja)\ **Replies:** 4\ **Last updated:** [April 29, 2022, 8:16pm UTC](https://community.auth0.com/t/token-failed-failed-to-get-token-error-invalid-grant-description-unknown-or-invalid-refresh-toke/82564 "2022-04-29T20:16:17Z")
PlatformException(token\_failed, Failed to get token: \[error: invalid\_grant, description: Unknown or invalid refresh token.\], null, null) Future init() async { final storedRefreshToken = await secureStorage.read(key:REF… --- ## [Multifactor authentication with rotating refresh](https://community.auth0.com/t/multifactor-authentication-with-rotating-refresh/46627)
**Author:** [@anthony.konschuh](https://community.auth0.com/u/anthony.konschuh)\ **Replies:** 7\ **Last updated:** [April 21, 2022, 4:58am UTC](https://community.auth0.com/t/multifactor-authentication-with-rotating-refresh/46627 "2022-04-21T04:58:18Z")
I’m trying to implement the rotating refresh token with my single page app using the auth0-spa-js SDK. Everything was working until I enabled MFA for the user I was testing with. Now when it tries to silent auth with the… --- ## [Can we get the IDP refresh\_token without forcing consent prompt?](https://community.auth0.com/t/can-we-get-the-idp-refresh-token-without-forcing-consent-prompt/80345)
**Author:** [@tom18](https://community.auth0.com/u/tom18)\ **Replies:** 2\ **Last updated:** [March 23, 2022, 7:36pm UTC](https://community.auth0.com/t/can-we-get-the-idp-refresh-token-without-forcing-consent-prompt/80345 "2022-03-23T19:36:59Z")
A separate, but very much related issue: Can we get the IDP refresh\_token without forcing users to go to the consent popup every time they log in? If the consent screen doesn’t appear, and a user don’t click “Allow”, w… --- ## [In laravel-auth0, the SDK is not exposed, so how can we renew tokens?](https://community.auth0.com/t/in-laravel-auth0-the-sdk-is-not-exposed-so-how-can-we-renew-tokens/79798)
**Author:** [@chris-workinggears](https://community.auth0.com/u/chris-workinggears)\ **Replies:** 2\ **Last updated:** [March 16, 2022, 1:44pm UTC](https://community.auth0.com/t/in-laravel-auth0-the-sdk-is-not-exposed-so-how-can-we-renew-tokens/79798 "2022-03-16T13:44:25Z")
Please include the following information in your post: Which SDK this is regarding: e.g. auth0-node auth0/laravel-auth0 SDK Version: e.g. 2.29.0 6.5 Platform Version: e.g. Node 12.19.0 PHP8.1 Currently, a… --- ## [Refresh Token does not include org and permission](https://community.auth0.com/t/refresh-token-does-not-include-org-and-permission/75924)
**Author:** [@ralemy](https://community.auth0.com/u/ralemy)\ **Replies:** 4\ **Last updated:** [January 7, 2022, 11:27pm UTC](https://community.auth0.com/t/refresh-token-does-not-include-org-and-permission/75924 "2022-01-07T23:27:19Z")
In a React-Express node application, I have refresh-token rotation enabled useRefreshTokens={true} cacheLocation="localstorage" scope="offline\_access" everything works, except that when I don’t use refresh tokens, … --- ## [How to refresh an access token in a Next.js application?](https://community.auth0.com/t/how-to-refresh-an-access-token-in-a-next-js-application/75806)
**Author:** [@will.dev8787](https://community.auth0.com/u/will.dev8787)\ **Replies:** 1\ **Last updated:** [January 4, 2022, 9:20pm UTC](https://community.auth0.com/t/how-to-refresh-an-access-token-in-a-next-js-application/75806 "2022-01-04T21:20:49Z")
Found this question which asks about exactly the same problem: user logs in (frontend application gets an access\_token); user updates its profile, frontend sends information to the backend, backend calls the Management… --- ## [Error refreshing access token: invalid\_grant Unknown or invalid refresh token](https://community.auth0.com/t/error-refreshing-access-token-invalid-grant-unknown-or-invalid-refresh-token/74127)
**Author:** [@raina](https://community.auth0.com/u/raina)\ **Replies:** 3\ **Last updated:** [December 7, 2021, 2:40pm UTC](https://community.auth0.com/t/error-refreshing-access-token-invalid-grant-unknown-or-invalid-refresh-token/74127 "2021-12-07T14:40:40Z")
For my mobile app I employ both passwordless (SMS) login and login via OIDC. When I try to refresh my access tokens, I receive the error message invalid\_grant Unknown or invalid refresh token. Note that I am including th… --- ## [Failing to call GET /api/v2/device-credentials endpoint](https://community.auth0.com/t/failing-to-call-get-api-v2-device-credentials-endpoint/73213)
**Author:** [@yasunori.mahata](https://community.auth0.com/u/yasunori.mahata)\ **Replies:** 3\ **Last updated:** [November 23, 2021, 9:10pm UTC](https://community.auth0.com/t/failing-to-call-get-api-v2-device-credentials-endpoint/73213 "2021-11-23T21:10:11Z")
I’m trying to revoke a refresh token with the Management API as described in the document. However, when I run a curl command as follows, it fails with the errorCode: “insufficient\_scope” $ curl --header "Authorization… --- ## [Refresh token expiry cases](https://community.auth0.com/t/refresh-token-expiry-cases/72601)
**Author:** [@mukhamed.khasanza](https://community.auth0.com/u/mukhamed.khasanza)\ **Replies:** 2\ **Last updated:** [November 17, 2021, 3:37pm UTC](https://community.auth0.com/t/refresh-token-expiry-cases/72601 "2021-11-17T15:37:16Z")
I want to clarify some specific cases, on how the refresh token behaves. Application settings: The access token is valid for 24 hours. Token rotation is enabled. Leeway is set to 10 seconds. Absolute lifetime is set… [Next page](https://community.auth0.com/tag/refresh-tokens/209.md?match_all_tags=true&page=1&tags%5B%5D=refresh-tokens)