# \#rotating-refresh-tokens **URL:** https://community.auth0.com/tag/rotating-refresh-tokens/2097.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Running into 'invalid\_grant' issues with MRRT](https://community.auth0.com/t/running-into-invalid-grant-issues-with-mrrt/201738)
**Author:** [@robin.martin](https://community.auth0.com/u/robin.martin)\ **Replies:** 1\ **Last updated:** [August 31, 2026, 6:45pm UTC](https://community.auth0.com/t/running-into-invalid-grant-issues-with-mrrt/201738 "2026-08-31T18:45:21Z")
I added a github issue, but not sure if it’s better to ask here as well. I noticed the auth0-spa-js lib doesn’t properly rotate refresh tokens with MRRT if the requests are sent in parallel since the lock on getSilentTo… --- ## [Unknown or invalid refresh token on Android and iOS](https://community.auth0.com/t/unknown-or-invalid-refresh-token-on-android-and-ios/196812)
**Author:** [@Arthur\_Dent](https://community.auth0.com/u/Arthur_Dent)\ **Replies:** 8\ **Last updated:** [June 5, 2026, 7:00pm UTC](https://community.auth0.com/t/unknown-or-invalid-refresh-token-on-android-and-ios/196812 "2026-06-05T19:00:30Z")
Greetings, Our team is facing some problems with auth0 in mobile apps (both, Android and iOS). We have looked through a lot of topics here but couldn’t find answers to our questions. The problem we’re facing is auth0 r… --- ## [Keep users logged in for a month or more using token rotation in cloud-based next.js webapps](https://community.auth0.com/t/keep-users-logged-in-for-a-month-or-more-using-token-rotation-in-cloud-based-next-js-webapps/197504)
**Author:** [@philipbattle](https://community.auth0.com/u/philipbattle)\ **Replies:** 4\ **Last updated:** [March 3, 2026, 3:59pm UTC](https://community.auth0.com/t/keep-users-logged-in-for-a-month-or-more-using-token-rotation-in-cloud-based-next-js-webapps/197504 "2026-03-03T15:59:47Z")
Usingreact-native-auth0 with “Allow Refresh Token Rotation” enabled, our app allows users to stay logged in for the “Maximum Refresh Token Lifetime” which we have set to a year. We call getCredentials() to get the access… --- ## [Sessions and Refresh Tokens](https://community.auth0.com/t/sessions-and-refresh-tokens/194346)
**Author:** [@nik.baleca](https://community.auth0.com/u/nik.baleca)\ **Replies:** 0\ **Last updated:** [November 11, 2025, 8:46pm UTC](https://community.auth0.com/t/sessions-and-refresh-tokens/194346 "2025-11-11T20:46:14Z")
Hello developers! :waving\_hand: Today I am back to provide some insight in regards to how Auth0 Sessions work and some guides/information on Refresh Tokens and to correctly use them within specific SDKs or configurations… --- ## [The user is logged out after one hour despite the use refresh tokens](https://community.auth0.com/t/the-user-is-logged-out-after-one-hour-despite-the-use-refresh-tokens/193298)
**Author:** [@Alex.the.seal](https://community.auth0.com/u/Alex.the.seal)\ **Replies:** 1\ **Last updated:** [October 17, 2025, 5:49pm UTC](https://community.auth0.com/t/the-user-is-logged-out-after-one-hour-despite-the-use-refresh-tokens/193298 "2025-10-17T17:49:22Z")
We’re seeing users get disconnected after roughly one hour, even though we use refresh tokens every 10 minutes. To meet security standards, we enabled refresh token rotation. Our assumption was that refresh tokens coul… --- ## [Auth0 refresh\_token exchange fails (“Invalid URL” / UnexpectedResponseError) with Remix Auth OAuth2Strategy](https://community.auth0.com/t/auth0-refresh-token-exchange-fails-invalid-url-unexpectedresponseerror-with-remix-auth-oauth2strategy/192895)
**Author:** [@anna.jacobsen](https://community.auth0.com/u/anna.jacobsen)\ **Replies:** 5\ **Last updated:** [October 10, 2025, 4:43pm UTC](https://community.auth0.com/t/auth0-refresh-token-exchange-fails-invalid-url-unexpectedresponseerror-with-remix-auth-oauth2strategy/192895 "2025-10-10T16:43:37Z")
I have a React Remix application, and I am trying to handle refreshing access tokens when they have expired. I have activated offline\_access and the OAuth2 strategy should be configured correctly. First i tried to use t… --- ## [Refresh token best practices](https://community.auth0.com/t/refresh-token-best-practices/191805)
**Author:** [@bryceb](https://community.auth0.com/u/bryceb)\ **Replies:** 1\ **Last updated:** [September 12, 2025, 7:11pm UTC](https://community.auth0.com/t/refresh-token-best-practices/191805 "2025-09-12T19:11:37Z")
Hello. Our application uses the Auth0 SPA SDK for authentication and validation when calling an API. Our refresh token configuration is as follows: Maximum ID Token lifetime: 7200 seconds Idle refresh token lifetime: … --- ## [Quick question about refresh tokens and sessions](https://community.auth0.com/t/quick-question-about-refresh-tokens-and-sessions/186417)
**Author:** [@henrikb](https://community.auth0.com/u/henrikb)\ **Replies:** 1\ **Last updated:** [May 19, 2025, 4:34pm UTC](https://community.auth0.com/t/quick-question-about-refresh-tokens-and-sessions/186417 "2025-05-19T16:34:10Z")
Hi, I’m trying to implement a SPA with some pages keeping the user logged in as long as possible, but I think got confused from accidentally having tenant idle session timeout set to the same time as max refresh token li… --- ## [Can't get token from local storage](https://community.auth0.com/t/cant-get-token-from-local-storage/186443)
**Author:** [@trevordammon](https://community.auth0.com/u/trevordammon)\ **Replies:** 1\ **Last updated:** [May 9, 2025, 5:08pm UTC](https://community.auth0.com/t/cant-get-token-from-local-storage/186443 "2025-05-09T17:08:30Z")
I am implementing a React sign on with local storage. I chose local storage because I don’t want my users to need to reauth every time they refresh the page. The problem I am having is that I seem unable to pull the to… --- ## [Issue with Refresh Token Grant Failing Due to mfa\_required (403 Forbidden)](https://community.auth0.com/t/issue-with-refresh-token-grant-failing-due-to-mfa-required-403-forbidden/186412)
**Author:** [@exchanga](https://community.auth0.com/u/exchanga)\ **Replies:** 4\ **Last updated:** [May 9, 2025, 5:07pm UTC](https://community.auth0.com/t/issue-with-refresh-token-grant-failing-due-to-mfa-required-403-forbidden/186412 "2025-05-09T17:07:42Z")
We are encountering an issue in our mobile application (Exchangapay) related to the refresh token flow. We have implemented silent access token refresh using the refresh\_token grant as per Auth0 guidelines. However, the … --- ## [ERR\_MISSING\_SESSION - AccessTokenError: The user does not have a valid session](https://community.auth0.com/t/err-missing-session-accesstokenerror-the-user-does-not-have-a-valid-session/186355)
**Author:** [@LukasKri](https://community.auth0.com/u/LukasKri)\ **Replies:** 2\ **Last updated:** [May 7, 2025, 8:46pm UTC](https://community.auth0.com/t/err-missing-session-accesstokenerror-the-user-does-not-have-a-valid-session/186355 "2025-05-07T20:46:16Z")
We have internal website build with Next.js App Router (v14.2.28) and “@auth0/nextjs-auth0” Next.js SDK (v3.7.0) integration and we see this error in server logs quite a lot, like 4-10 times per second, depending on acti… --- ## [Refresh tokens and getAccessTokenSilently behaviour](https://community.auth0.com/t/refresh-tokens-and-getaccesstokensilently-behaviour/185292)
**Author:** [@miguel.rosa](https://community.auth0.com/u/miguel.rosa)\ **Replies:** 3\ **Last updated:** [April 18, 2025, 6:56pm UTC](https://community.auth0.com/t/refresh-tokens-and-getaccesstokensilently-behaviour/185292 "2025-04-18T18:56:32Z")
Hi, I’ve been searching and reading and there is something I’m missing out. I understand that because of browsers ITP technology simply calling the getAccessTokenSilently() fails. And I see in the logs the following: … --- ## [Auth0-aspnetcore-authentication "UserRefreshToken = true;" is not refreshing tokens in Blazor Server](https://community.auth0.com/t/auth0-aspnetcore-authentication-userrefreshtoken-true-is-not-refreshing-tokens-in-blazor-server/182843)
**Author:** [@jeffcodes](https://community.auth0.com/u/jeffcodes)\ **Replies:** 18\ **Last updated:** [April 4, 2025, 2:08pm UTC](https://community.auth0.com/t/auth0-aspnetcore-authentication-userrefreshtoken-true-is-not-refreshing-tokens-in-blazor-server/182843 "2025-04-04T14:08:30Z")
Here is the TL;DR version: When adding the setting UserRefreshToken = true; to Program.cs (see the larger code snippet at the bottom of this page for more detail), what exactly is the behavior supposed to be within an As… --- ## [Invalid access token returned when using refresh token](https://community.auth0.com/t/invalid-access-token-returned-when-using-refresh-token/148742)
**Author:** [@alan.stead](https://community.auth0.com/u/alan.stead)\ **Replies:** 2\ **Last updated:** [March 20, 2025, 2:05am UTC](https://community.auth0.com/t/invalid-access-token-returned-when-using-refresh-token/148742 "2025-03-20T02:05:33Z")
Ready to post? :mag: First, try searching for your answer. I’ve got a react app with a nodejs backend and a cloud database. I’m new to auth0 to trying to get it all setup. I had simple user authentication setup using th… --- ## [How can I auto-signout after periods of inactivity?](https://community.auth0.com/t/how-can-i-auto-signout-after-periods-of-inactivity/169804)
**Author:** [@royvivat](https://community.auth0.com/u/royvivat)\ **Replies:** 2\ **Last updated:** [January 23, 2025, 6:54pm UTC](https://community.auth0.com/t/how-can-i-auto-signout-after-periods-of-inactivity/169804 "2025-01-23T18:54:04Z")
Our current flow uses JWTs and at this point in the project, we cannot change that. How can I implement session-like functionality with auto-signout after periods of inactivity using JWT refresh tokens? Is this alread… --- ## [Persisting refreshed tokens in a session in server components](https://community.auth0.com/t/persisting-refreshed-tokens-in-a-session-in-server-components/167719)
**Author:** [@developers11](https://community.auth0.com/u/developers11)\ **Replies:** 1\ **Last updated:** [January 14, 2025, 8:34pm UTC](https://community.auth0.com/t/persisting-refreshed-tokens-in-a-session-in-server-components/167719 "2025-01-14T20:34:14Z")
We use Apollo client in Server Components to make queries to our external (non Next.js) API and have to pass access token in ‘authorization’ header. We use getAccessToken() function to get token (and refresh if needed).… --- ## [Refresh tokens in flutter web SPA](https://community.auth0.com/t/refresh-tokens-in-flutter-web-spa/164344)
**Author:** [@amirali](https://community.auth0.com/u/amirali)\ **Replies:** 3\ **Last updated:** [January 13, 2025, 6:54pm UTC](https://community.auth0.com/t/refresh-tokens-in-flutter-web-spa/164344 "2025-01-13T18:54:55Z")
I’ve followed every guide and forum I could find related to getting an Auth0 refresh token in a flutter web SPA. But it’s still returning null. I can see in the network inspector that there is a refresh token along with… --- ## [NextJS-Auth0 Refresh Token setup](https://community.auth0.com/t/nextjs-auth0-refresh-token-setup/112088)
**Author:** [@luiz](https://community.auth0.com/u/luiz)\ **Replies:** 2\ **Last updated:** [December 5, 2024, 11:32pm UTC](https://community.auth0.com/t/nextjs-auth0-refresh-token-setup/112088 "2024-12-05T23:32:09Z")
Hi, I’m using the @auth0/nextjs-auth0 package in a NextJS application with an external GraphQL API. We are trying to block the user to use the appSession cookie to call the API after logout. Since is impossible to inval… --- ## [@auth0/nextjs-auth0 getAccessToken Error](https://community.auth0.com/t/auth0-nextjs-auth0-getaccesstoken-error/106351)
**Author:** [@xdyer](https://community.auth0.com/u/xdyer)\ **Replies:** 1\ **Last updated:** [December 3, 2024, 8:10pm UTC](https://community.auth0.com/t/auth0-nextjs-auth0-getaccesstoken-error/106351 "2024-12-03T20:10:19Z")
Hello, I am working on implementing some logic into my nextjs endpoints that refreshes an api access token using a refresh token when the current token has expired. Here is a sample of my current code: import { getAc… --- ## [Auth0VueClient.isAuthenticated always returns false after page refresh, checkSession does not help](https://community.auth0.com/t/auth0vueclient-isauthenticated-always-returns-false-after-page-refresh-checksession-does-not-help/100305)
**Author:** [@Balthazar](https://community.auth0.com/u/Balthazar)\ **Replies:** 1\ **Last updated:** [November 21, 2024, 10:00pm UTC](https://community.auth0.com/t/auth0vueclient-isauthenticated-always-returns-false-after-page-refresh-checksession-does-not-help/100305 "2024-11-21T22:00:49Z")
Hi I am working on a Vue 3.0 SPA in which some features are password protected with New Universal Login, and no Custom Domain. I’m testing it on localhost. It’s not yet deployed. If I refresh the browser, the UI shows m… --- ## [Is it possible to have refresh token rotation with sliding expiry?](https://community.auth0.com/t/is-it-possible-to-have-refresh-token-rotation-with-sliding-expiry/145469)
**Author:** [@Selva](https://community.auth0.com/u/Selva)\ **Replies:** 1\ **Last updated:** [September 10, 2024, 3:41am UTC](https://community.auth0.com/t/is-it-possible-to-have-refresh-token-rotation-with-sliding-expiry/145469 "2024-09-10T03:41:18Z")
Hi Greetings! Is it possible to have Refresh tokens with Sliding expiry? If the Refresh Token Rotation is enabled, Absolute lifetime becomes mandatory. It can’t be turned off. User will be asked to sign-in when the c… --- ## [JWE received instead of standard JWS](https://community.auth0.com/t/jwe-received-instead-of-standard-jws/142142)
**Author:** [@gokul.er137](https://community.auth0.com/u/gokul.er137)\ **Replies:** 1\ **Last updated:** [August 30, 2024, 8:27pm UTC](https://community.auth0.com/t/jwe-received-instead-of-standard-jws/142142 "2024-08-30T20:27:42Z")
I am on the free tier so I don’t have JWE enabled. However, when setting up access tokens for session management, jwt.io indicates that my token is encrypted (it starts off like ey…). So, I am not sure how to get a stan… --- ## [Next.js 13 how to Access an External API from an API Route using App Router api route?](https://community.auth0.com/t/next-js-13-how-to-access-an-external-api-from-an-api-route-using-app-router-api-route/116459)
**Author:** [@arundas.tc](https://community.auth0.com/u/arundas.tc)\ **Replies:** 4\ **Last updated:** [July 26, 2024, 1:17am UTC](https://community.auth0.com/t/next-js-13-how-to-access-an-external-api-from-an-api-route-using-app-router-api-route/116459 "2024-07-26T01:17:15Z")
I have this code that supposedly accesses an external API using the Next.js SDK. // app/api/test/route.ts (Typescript) import { NextResponse } from 'next/server' import { getAccessToken, withApiAuthRequired } from '@aut… --- ## [Notifying users before refresh tokens get expired](https://community.auth0.com/t/notifying-users-before-refresh-tokens-get-expired/131995)
**Author:** [@tks](https://community.auth0.com/u/tks)\ **Replies:** 1\ **Last updated:** [April 22, 2024, 8:50pm UTC](https://community.auth0.com/t/notifying-users-before-refresh-tokens-get-expired/131995 "2024-04-22T20:50:30Z")
Hi there, We’re building a single page application with refresh tokens enabled. Since Refresh Token Expiration is configured, users will be logged out after the specific inactive period. We’d like to let users know whe… --- ## [Does a refresh token's family that is in a rotation expire when used within a refresh token's absolute lifetime](https://community.auth0.com/t/does-a-refresh-tokens-family-that-is-in-a-rotation-expire-when-used-within-a-refresh-tokens-absolute-lifetime/128150)
**Author:** [@CloudNStoyan](https://community.auth0.com/u/CloudNStoyan)\ **Replies:** 2\ **Last updated:** [March 29, 2024, 7:52pm UTC](https://community.auth0.com/t/does-a-refresh-tokens-family-that-is-in-a-rotation-expire-when-used-within-a-refresh-tokens-absolute-lifetime/128150 "2024-03-29T19:52:51Z")
Given we have enabled the Refresh Token Rotation and have a refresh token family, does the whole family expire at any time or does it only expire when the latest refresh token’s absolute lifetime is reach. If thats the … --- ## [Refresh Token lifetime greater than Session Lifetime](https://community.auth0.com/t/refresh-token-lifetime-greater-than-session-lifetime/130009)
**Author:** [@lbarbosa](https://community.auth0.com/u/lbarbosa)\ **Replies:** 1\ **Last updated:** [March 20, 2024, 12:06am UTC](https://community.auth0.com/t/refresh-token-lifetime-greater-than-session-lifetime/130009 "2024-03-20T00:06:28Z")
Hello, I have a question regarding the behavior of user sessions with the refresh token’s token\_lifetime set to 3 years and the Session Lifetime at the tenant level set to 1 year. Does this refresh token configuration m… --- ## [Oauth/token endpoint response is slow](https://community.auth0.com/t/oauth-token-endpoint-response-is-slow/126304)
**Author:** [@luca1](https://community.auth0.com/u/luca1)\ **Replies:** 6\ **Last updated:** [February 20, 2024, 3:13pm UTC](https://community.auth0.com/t/oauth-token-endpoint-response-is-slow/126304 "2024-02-20T15:13:24Z")
Hi everyone, We are experiencing a number of slow calls to the oauth/token endpoint and we are trying to understand what is causing them. Our system uses short-lived (2 minutes) access token and we call getAccessTokenS… --- ## [Authentication from iframe with 3rd party cookies disabled](https://community.auth0.com/t/authentication-from-iframe-with-3rd-party-cookies-disabled/120463)
**Author:** [@ajv](https://community.auth0.com/u/ajv)\ **Replies:** 2\ **Last updated:** [January 31, 2024, 9:22am UTC](https://community.auth0.com/t/authentication-from-iframe-with-3rd-party-cookies-disabled/120463 "2024-01-31T09:22:54Z")
I’ve found a few similar threads around CORS auth with 3rd party cookies disabled, but our setup is a little different + all those threads have been left unanswered for months (and are now closed). We have a SPA where a… --- ## [Unknown or invalid refresh token error](https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975)
**Author:** [@vuscan.marius](https://community.auth0.com/u/vuscan.marius)\ **Replies:** 6\ **Last updated:** [November 6, 2023, 5:02pm UTC](https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975 "2023-11-06T17:02:38Z")
Hello, Occasionally, I am getting this error: Status Code: 403 { “error”: “invalid\_grant”, “error\_description”: “Unknown or invalid refresh token.” } I am using the Angular SPA flow. I have enabled refresh tokens … --- ## [PHP - get updated credentials, while user is logged in](https://community.auth0.com/t/php-get-updated-credentials-while-user-is-logged-in/115869)
**Author:** [@toomuchtimeondocs](https://community.auth0.com/u/toomuchtimeondocs)\ **Replies:** 4\ **Last updated:** [September 13, 2023, 11:07pm UTC](https://community.auth0.com/t/php-get-updated-credentials-while-user-is-logged-in/115869 "2023-09-13T23:07:23Z")
I’m having uproblem with getting updated information in PHP-SDK Scenario: User registers for account and is being logged into the app In getCredentials response, I have email\_verified as false Users verifies emails I … [Next page](https://community.auth0.com/tag/rotating-refresh-tokens/2097.md?match_all_tags=true&page=1&tags%5B%5D=rotating-refresh-tokens)