Protect OAuth token state by limiting what you store, encrypting it at a layer suited to your threat model, keeping encryption keys separate from the data, and excluding raw credentials from logs. For public clients, the authorization server—not the client’s storage code—must provide refresh-token replay protection through sender-constrained tokens or refresh-token rotation. These controls reduce exposure; encryption alone cannot protect secrets from a compromised running application.
Why refresh tokens need vault-level protection
A refresh token can let its holder obtain new access tokens and act with the authority granted to the client. Treat it as a high-value credential, not as ordinary application state. RFC 6749 requires refresh tokens to remain confidential in transit and storage, to be shared only between the authorization server and the client to which they were issued, and to travel over TLS. RFC 6749
As an Amazon Associate I earn from qualifying purchases.
Access tokens also require secret-handling discipline. RFC 9700 says a resource server must treat access tokens like other sensitive secrets and must not store or transfer them in plaintext. RFC 9700
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWho is responsible for refresh-token rotation?
Rotation is an authorization-server capability. A client can securely store and use the replacement token it receives, but it cannot create server-side replay detection on its own. Under the OAuth 2.0 Security Best Current Practice, published by the IETF in January 2025, public clients’ refresh tokens must be sender-constrained or use rotation. The authorization server must support and enforce the selected defense. RFC 9700
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How rotation detects reuse
- The client presents its current refresh token to the authorization server.
- The server returns a new refresh token and invalidates the old one, retaining enough relationship data to recognize the token lineage.
- If an invalidated token is presented again, the server can treat that reuse as evidence that the token may have been copied or compromised and revoke the active refresh token.
Rotation detects reuse; it does not prevent an attacker from using a stolen token before the legitimate client does. If reuse is detected, revoking the active token can require the legitimate user to authorize again.
When sender constraint may fit better
Sender-constrained tokens require proof tied to a particular client or key when the token is used. Mutual TLS and Demonstrating Proof of Possession (DPoP) are examples recognized by RFC 9700. This approach can make a stolen token less useful without the associated proof, but it depends on authorization-server support and safe handling of the bound key. If an attacker obtains both the token and its key material, the protection is weakened.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose token-state encryption by threat model
There is no universally correct encryption layer for stored token state. OWASP recommends first identifying the threat and minimizing sensitive information retained. Application-level, database, filesystem, or hardware encryption can each be appropriate in different deployments; one layer does not cover every compromise scenario. OWASP Cryptographic Storage Cheat Sheet
| Storage layer | What it can help with | Important boundary |
|---|---|---|
| Application-level encryption | Can keep stored values encrypted before they reach a database or storage service, depending on where decryption occurs. | A compromised live application that can decrypt the values may expose them. |
| Database encryption | Can help protect database files or storage disclosures, depending on the database configuration. | It does not necessarily protect data available to an authorized or compromised application or database process. |
| Filesystem or disk encryption | Can help against loss or physical theft of storage media. | It does not by itself protect a running host from remote compromise. |
| Hardware encryption | May help protect against physical theft, depending on the deployment. | OWASP cautions that it does not protect against remote server compromise. |
These layers are not mutually exclusive. Choose based on the likely exposure—such as a database disclosure, lost storage media, host compromise, or application compromise—and where the decryption capability resides. Encryption at rest is not a substitute for access control, patching, runtime security, or minimizing token access.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use maintained cryptography
For symmetric encryption, OWASP recommends AES with a key of at least 128 bits, ideally 256 bits, in a secure mode. Use maintained cryptographic libraries rather than designing a custom storage scheme. The key-size recommendation is a technical guideline, not a guarantee that the whole system is secure. OWASP Cryptographic Storage Cheat Sheet
Keep encryption keys separate from token state
Encrypting tokens helps only if the keys that decrypt them are protected independently. Do not hard-code keys or check them into version control, and avoid storing a key beside the ciphertext unless the key itself is protected—for example, through envelope encryption. OWASP Cryptographic Storage Cheat Sheet
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Depending on requirements, key custody can use an HSM, virtual HSM, cloud key vault, or external secrets-management system. Central key management and rotation can be useful, but these systems add integration and administrative work. A physical HSM is not a universal requirement: select key custody based on policy, threat model, recovery needs, and operational capacity. OWASP Cryptographic Storage Cheat Sheet
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Make logs useful without recording secrets
Keep refresh tokens, access tokens, session identifiers, authorization headers, and cookies out of plaintext logs. Also exclude sensitive request or response bodies before logs are collected. OWASP recommends avoiding sensitive data in logs; where session correlation is necessary, it suggests replacing session identifiers with hashed values. OWASP Secrets Management Cheat Sheet OWASP Session Management Cheat Sheet
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use an allow-listed event schema rather than logging whole requests or responses. A practical event can record:
- Event type and timestamp
- Outcome, such as success, denial, or error category
- Route or operation
- A non-secret actor identifier or correlation identifier
When investigations require correlation across events, use a non-secret identifier or a carefully designed hash; do not log the credential itself. Restrict access to logs as well: omitting token values does not make operational data harmless.
Quick Recap
Review the design against likely failures
- Database disclosure: confirm whether stored tokens are encrypted before or within the database, and whether database access can also reach the decryption key.
- Host or application compromise: assume a running component with token-use or decryption privileges may expose credentials; encryption at rest alone does not solve this case.
- Refresh-token replay: verify that a public client uses authorization-server-supported rotation or sender constraint, and understand what revocation and user recovery look like after suspected reuse.
- Logging incident: test that headers, cookies, token-bearing bodies, and session IDs are excluded or transformed before ingestion.
- Key loss or rotation: establish who can rotate and recover keys, how access is audited, and what happens to encrypted token state during recovery.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
