Refresh tokens going stale

[dan]

Will the refresh token go “stale” and be invalid if there is a set amount of time without any activity on a refresh token? Example:

Bob authenticates and obtains an authentication token as well as a refresh token. He does not use the refresh token for > 24 hours. When he attempts to use it to obtain a new authentication token, which will happen?

1. He’ll get a new auth token via the refresh token since it’s expiry is 2 weeks
2. He’ll have to reauthenticate because ??

[dan]

This is configurable. Go to https://fusionauth.io/docs/v1/tech/core-concepts/tenants/#jwt (though the screencaps are a bit out of date) but you’ll go there in your instance.

You’ll see refresh token settings.

If you’re using a fixed expiration, then it never expires based on last usage, but just based upon time since it was issued.

If you’re using a sliding window expiration, then it will expire based upon the time since it was last used.