Validate refresh tokens
-
Hi,
How can I validate a refresh token to see if it is a valid?
--
FusionAuth - Auth for devs, built by devs.
https://fusionauth.io -
A refresh token is opaque; you cannot validate it yourself.
The general pattern for validating a refresh token is to use it to refresh the JWT, and if the refresh attempt fails, that indicates the refresh token is no longer valid.
You could also retrieve a user’s refresh tokens and compare it to the ones returned by FusionAuth.
More details:
https://fusionauth.io/docs/v1/tech/apis/jwt#refresh-a-jwt
https://fusionauth.io/docs/v1/tech/apis/jwt#retrieve-refresh-tokens
