What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use one coordinated refresh path for both cases: refresh shortly before a known access-token expiry, or refresh after a resource server identifies the bearer token as invalid. On a 401, check the bearer challenge rather than refreshing blindly. Coalesce simultaneous refreshes, save the new access token and any rotated refresh token together, then retry the request at most once when replay is safe. If the authorization server rejects the refresh token, the user will generally need to authorize again.
Know which token goes where
An access token is sent to a resource server to access a protected API. A refresh token is sent to the authorization server’s token endpoint to obtain a new access token; it is not a substitute credential to send to the API. OAuth does not require every authorization server to issue refresh tokens, so clients must handle sessions that have no refresh token (RFC 6749).
The renewal pathway below has two triggers but one shared operation: a refresh coordinator for the relevant user session or token set. The standards define token and error behavior; they do not prescribe a universal expiry buffer, retry count, mutex, or storage transaction.
Refresh before a known expiry
If the token response provides an expiry duration, calculate and store an expiry instant alongside the token state. A client can refresh shortly before that instant to reduce the chance that a request arrives after the token expires. There is no standard lead time: choose a buffer based on your network latency and clock behavior, and treat it as an implementation setting rather than an OAuth rule.
#1 Best Overall
- Record the token response. Keep the access token, its expiry instant when supplied, and the refresh token if one was issued.
- Check before use. When a request needs an access token, compare the current time with the stored expiry and your chosen buffer. If it is within the refresh window, call the shared refresh operation instead of starting a separate refresh flow.
- Persist the response as one state update. Replace the access token and, if the response includes a replacement refresh token, replace that too. Do not let waiting requests proceed with a partially updated token set.
Expiry information and refresh behavior vary by authorization server. Do not assume that a refresh token has the same lifetime as the access token or that each refresh extends the authorization grant indefinitely.
Refresh after a 401 only when the bearer token is invalid
Inspect the response’s authentication challenge and error details where available. Under bearer-token usage, invalid_token includes an expired, revoked, malformed, or otherwise invalid access token. RFC 6750 describes a 401 response with WWW-Authenticate: Bearer and error="invalid_token" for an expired token, and says the client may request a new access token and retry the protected-resource request (RFC 6750).
Rank #2
A 401 alone does not prove refreshing will help. For example, a request with missing credentials may not include an error code. A 403 with insufficient_scope indicates inadequate privilege, not an expired token; ordinary refresh does not fix it unless the authorization server can issue a token with the required scope.
- Check the response. Confirm that it identifies a bearer-token problem, preferably with
invalid_token, before attempting renewal. - Join or start the shared refresh. If a refresh is already in progress for this session, wait for its result instead of submitting the same refresh token again.
- Retry only after success. Once the new access token and any replacement refresh token are saved, replay the failed request only if its operation is safe to replay under your application’s semantics.
- Stop after one retry. Mark the request as already retried. If it fails again, surface the failure instead of entering a refresh-and-retry loop.
The one-refresh coordination, replay-safety check, and retry limit are engineering guidance; RFC 6750 permits requesting a fresh access token and retrying but does not prescribe this interceptor design.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #3
- Used Book in Good Condition
Coordinate refreshes and token rotation
Concurrent requests can discover an expired access token at nearly the same time. If each independently submits the same refresh token, rotation can make the race destructive: one exchange may succeed and invalidate the old refresh token while another submits that now-invalid predecessor.
Use one in-flight refresh job per relevant session or token set. Other requests wait for that job and use its result. Save the new access token and any returned refresh token together before releasing those callers. This coordination and atomic-update approach follows from the replacement-token behavior in OAuth and rotation/replay handling in current security guidance; the RFCs do not mandate a specific lock or database transaction.
RFC 6749 requires a client receiving a replacement refresh token to discard the old token and replace it with the new one. Keeping or later submitting an invalidated predecessor can cause refresh failure (RFC 6749).
Choose refresh-token protection for the client architecture
Refresh tokens are valuable targets. Protect them in transit and at rest, bind their use to the client, and limit them to the consented scopes and resource servers as appropriate. The right storage boundary depends on where the OAuth client runs, rather than on one universal storage recipe.
Recommended Free Tools
| Client pattern | Where the refresh token is handled | Main implementation consideration |
|---|---|---|
| Confidential backend or backend-for-frontend (BFF) | The backend can keep the refresh token server-side and associate it with the user’s session. | Protect server-side token storage and coordinate refreshes for the associated session. |
| Browser-only public client | The application handles tokens in the browser. | Browser exposure makes token protection especially important; follow the browser-specific architecture guidance rather than assuming backend protections apply. |
For public clients, RFC 9700 requires refresh tokens to be sender-constrained or rotated. Rotation issues a fresh token and invalidates its predecessor. It can reveal reuse, but the authorization server may not know whether the legitimate client or an attacker presented the old value; detected replay can therefore lead it to revoke the active token and force a new authorization grant (RFC 9700).
For browser-based applications, RFC 10017 covers browser-only clients, token-mediating backends, and BFF patterns. Match token storage and exposure controls to the chosen pattern rather than treating browser and server-side clients as interchangeable (RFC 10017).
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Handle refresh rejection and expiry as reauthorization
A refresh token may expire, be revoked, be invalidated by rotation, or be revoked after an event such as logout or a password change. If the authorization server rejects it, stop retrying that same value. Invalidate the local authenticated session as appropriate and send the user through authorization again.
Refresh-token expiry is set by authorization-server policy. RFC 9700 recommends expiry after inactivity. For browser-based applications, RFC 10017 calls for a maximum lifetime or inactivity expiry and says rotation must not extend a pre-established initial expiry. Once that refresh-token lifetime ends, another valid access token requires a new Authorization Code grant. Where the maximum lifetime is known, a browser implementation can align its session lifetime with it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
