[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-refresh-token::en":3,"gloss-cluster-refresh-token::en":26,"gloss-next-refresh-token::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"refresh-token","integration","Refresh Token","A refresh token is a long-lived credential whose only job is to obtain new short-lived access tokens. The split exists because two requirements pull in opposite directions: an access token is sent on every API call and should expire quickly so a leaked one stops working within minutes, while a user or an integration should not have to re-authorise every hour. The access token is spent constantly and worth little; the refresh token is used rarely, travels only to the authorisation server, and is worth a great deal. For a SaaS product this is usually the least visible part of an integration and the most common reason one goes quiet. A connection that worked at setup fails weeks later because the refresh token hit a fixed absolute lifetime, or was revoked when the user changed their password, or because the grant was withdrawn from a consent screen nobody on your team can see. The API returns an authorisation error rather than a sync error, so a naive retry loop hammers the endpoint and the customer discovers the outage before you do. Two design decisions matter. Refresh-token rotation issues a new refresh token with every use and invalidates the previous one, which turns a stolen token into a detectable event: if the old token is presented again, either an attacker or the legitimate client is replaying, and the safe response is to revoke the whole chain. And storage must be treated as credential storage, encrypted at rest, never in logs, never in a URL, scoped to one tenant. The practical build advice is to keep the expiry alongside the token, refresh proactively before it lapses rather than reactively on the first failure, and surface a broken connection in the product interface as an action the customer can take, because only they can re-authorise.","A refresh token buys new short-lived access tokens: why rotation matters, and why an integration that worked at setup goes quiet weeks later.",null,[11,14,17,20,23],{"slug":12,"name":13},"api-key","API Key",{"slug":15,"name":16},"json-web-token","JSON Web Token (JWT)",{"slug":18,"name":19},"key-rotation","Key Rotation",{"slug":21,"name":22},"oauth-scopes","OAuth Scopes",{"slug":24,"name":25},"service-account","Service Account",[27,31,34,37,40,43,47,50,53,54,57,60],{"slug":28,"category":5,"name":29,"updated_at":30},"backend-for-frontend","Backend for Frontend (BFF)","2026-08-24T02:46:38+00:00",{"slug":32,"category":5,"name":33,"updated_at":30},"concurrency-limit","Concurrency Limit",{"slug":35,"category":5,"name":36,"updated_at":30},"event-ordering","Event Ordering",{"slug":38,"category":5,"name":39,"updated_at":30},"field-mapping","Field Mapping",{"slug":41,"category":5,"name":42,"updated_at":30},"function-schema","Function Schema",{"slug":44,"category":5,"name":45,"updated_at":46},"grpc","gRPC","2026-08-24T02:46:37+00:00",{"slug":48,"category":5,"name":49,"updated_at":30},"integration-marketplace","Integration Marketplace",{"slug":51,"category":5,"name":52,"updated_at":30},"ip-allowlist","IP Allowlist",{"slug":15,"category":5,"name":16,"updated_at":30},{"slug":55,"category":5,"name":56,"updated_at":30},"mcp-server","MCP Server",{"slug":58,"category":5,"name":59,"updated_at":30},"mutual-tls","Mutual TLS (mTLS)",{"slug":21,"category":5,"name":22,"updated_at":30}]