Refresh Flow

Access tokens expire quickly. Refresh tokens rotate automatically and are stored in Redis to prevent replay attacks.

API: refreshToken

refresh.ts

// The old token becomes invalid after this call.
const tokens = await auth.refreshToken(oldRefreshToken);

// Reusing oldRefreshToken is rejected.
// Concurrent refresh attempts are locked in Redis.

:::caution Token rotation After calling refreshToken, the previous refresh token is immediately invalidated. Store and use only the new token returned in the response. :::