Use one coordinated refresh pathway for both cases: refresh shortly before a known access-token expiry, or refresh after a resource server identifies the bearer token as invalid_token. Save the new access token and any rotated refresh token together, then retry the failed request once when it is safe to replay. A generic 401, a 403, or a rejected refresh token needs a different response—not an automatic refresh loop.
Keep the two OAuth tokens’ jobs separate
An access token is presented to a resource server to access a protected API. A refresh token is sent to the authorization server’s token endpoint to obtain a new access token; it is not a substitute credential for the API. OAuth does not require every authorization server to issue refresh tokens. See RFC 6749.
As an Amazon Associate I earn from qualifying purchases.
When a token response includes an access-token lifetime, keep the access token, refresh token, and calculated expiry instant as one session’s token state. If the provider does not supply a lifetime, do not invent one: use the provider’s documented behavior or rely on the resource server’s response to identify invalid tokens.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsChoose the refresh trigger from the evidence available
| Trigger | What it tells the client | Client action |
|---|---|---|
| Known expiry is approaching | The token response supplied an expiry duration, from which the client can calculate an expiry instant. | Optionally refresh before expiry using a lead time chosen for the deployment. |
401 with a bearer challenge indicating invalid_token |
The resource server says the presented access token is expired, revoked, malformed, or otherwise invalid. | Attempt the shared refresh operation; retry the request only if refresh succeeds and replay is safe. |
| 401 without an identifying bearer error | The response alone does not establish that refresh will fix the problem. Credentials may be missing or the cause may be unrelated. | Do not refresh solely because the status is 401; handle the response according to the API’s authentication contract. |
403 with insufficient_scope |
The token lacks the required privilege. | Do not treat ordinary refresh as a fix. The user or client may need authorization with different scope. |
Refresh before expiry when it is useful
Proactive refresh can avoid sending a request with an access token that is about to expire. There is no universal standards-defined buffer. Choose one based on observed request latency, clock behavior, and the cost of a failed request; treat it as an implementation setting, not a property guaranteed by OAuth. Do not assume refresh-token lifetime matches access-token lifetime, or that each replacement extends the original authorization indefinitely.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A single shared refresh operation should serve both the proactive path and the reactive 401 path. When several requests discover expiry at once, they should wait for that operation rather than each submitting the same refresh token.
Handle a 401 by checking the bearer error
RFC 6750 describes an expired bearer access token response as HTTP 401 with a WWW-Authenticate: Bearer challenge and error="invalid_token". Its definition of invalid_token includes expired, revoked, malformed, or otherwise invalid tokens. In that case, the client may request a new access token and retry the protected-resource request. The standard distinguishes this from insufficient_scope, which is associated with 403. Read RFC 6750.
Do not infer invalid_token from every 401. Inspect the challenge and any API-specific error body. If the server does not identify an invalid bearer token, refreshing may waste a valid refresh token and cannot fix missing credentials or unrelated authorization failures.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Coordinate refreshes and replace token state atomically
Refresh-token rotation makes concurrent refreshes especially risky: the authorization server can return a new refresh token and invalidate the old one. Two requests that submit the same predecessor can race; one may succeed while another fails, and retaining the old value can leave the client unable to refresh again.
- Check current state. Before starting a refresh, check whether another operation has already installed a still-usable access token.
- Join or start one refresh. Maintain one in-flight refresh job per session or token set. Waiting callers use its result rather than independently submitting the same refresh token.
- Call the token endpoint. Send the refresh token to the authorization server, not to the resource server. Follow the provider’s client-authentication and token-endpoint requirements.
- Commit the complete response as one update. Store the new access token, its expiry when supplied, and the replacement refresh token if returned before releasing waiting callers. Under RFC 6749, a returned replacement refresh token must replace the old one.
- Release callers with the new access token. A failed refresh must propagate as failure; do not replay the protected request using the expired credential.
RFC 6749 defines replacement-token behavior, and RFC 9700 explains the security role of rotation and replay detection. Neither specifies a universal mutex, promise, storage transaction, or retry count. The coordination and atomic persistence above are implementation guidance derived from the consequences of replacement and rotation.
Retry once, and only when replay is safe
For a request rejected with invalid_token, mark it as already retried, invoke the shared refresh operation, and replay it only after receiving a new access token. Limit the retry to one refresh attempt for that request so a second 401 cannot create an unbounded loop.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE C Connectivity & DONGLE Design: Designed for PCs, Macs, laptops, iPhones, and Android devices that utilize a USB-C port. Plug and stay, or carry it on a keychain. (Item Size: 0.73 x 0.60 x 0.30 inches)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
Also consider the request’s application semantics. A GET is commonly replayable, but a request that changes server state may have completed despite a lost or ambiguous response. Replay such operations only when the API and application provide suitable idempotency or deduplication guarantees. These retry limits and replay-safety checks are engineering safeguards, not a universal retry algorithm mandated by RFC 6750.
Recommended Free Tools
Know when refresh must end in reauthorization
A refresh token may expire, be revoked, be invalidated by rotation, or be revoked after a security event such as logout or a password change. If the authorization server rejects it, stop retrying that same value. Invalidate the local authenticated session as appropriate and send the user through authorization again. For browser applications, RFC 10017 explains that an expired refresh token cannot produce another valid access token without a new Authorization Code grant.
Refresh-token lifetime is authorization-server policy. RFC 9700 recommends expiration after inactivity; browser-based guidance in RFC 10017 also addresses maximum lifetime or inactivity expiry and says rotation must not extend a previously established initial expiry. A provider’s replacement token therefore should not be assumed to renew authorization forever.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C Nano is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C Nano secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: The YubiKey 5C Nano is designed to stay plugged into your device via USB-C. Simply tap it to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Protect refresh tokens for the client architecture
Refresh tokens are valuable credentials: protect them in transit and storage, bind their use to the client, and keep their authority aligned with consented scopes and resource servers. Apply the requirements and guidance in RFC 6749, RFC 9700, and, for browser deployments, RFC 10017.
- Confidential backend or BFF: Keep refresh tokens on the server and associate them with the user’s server-side session where that architecture applies.
- Public browser client: The application has greater responsibility for token exposure and storage. Public clients must use sender-constrained refresh tokens or rotation under RFC 9700.
- Rotation: A newly issued refresh token invalidates its predecessor. Reuse detection can cause the authorization server to revoke the active token because it cannot necessarily distinguish the legitimate client from an attacker. The result may be a required new authorization grant.
- Sender-constraining: Binding token use to a client-held key can reduce the usefulness of a stolen token; use the mechanism supported by the authorization server and client architecture.
Browser deployment patterns differ: browser-only clients, token-mediating backends, and backend-for-frontend designs place credentials in different trust boundaries. Use the storage and exposure model appropriate to the actual pattern rather than assuming one storage mechanism fits all.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
