Definition
A refresh token is a long-lived credential exchanged at the token endpoint for a fresh access token, letting applications maintain sessions without re-authenticating the user.
In more depth
Refresh tokens enable long-lived sessions while keeping access tokens short-lived (limiting blast radius if leaked). OAuth 2.1 mandates refresh-token rotation for public clients — each use returns a new refresh token and invalidates the old one.
Reuse detection: if a previously-used refresh token is presented, the authorization server revokes the entire chain — assuming refresh-token leakage. This is critical security hygiene.
Want the work, not just the definition?