refresh token always valid

[fusionauth_user]

So im not sure if i understand it correctly, but i have set up my refreshtoken to be single use only on my applications settings, but i can just keep using the old refresh token to get new access tokens.

Is this right?

[dan]

Hmmm. What version of FusionAuth are you running?

If you have set the refresh token usage policy to be OneTime in the tenant settings, then the old refresh token shouldn't give you access tokens after the first call.