Is `auth_time` in refresh token metadata reliable for MFA + PASSWORD flows?

FASupportBot — Invalid Date

The data sub-object containing auth_time and authentication_type in refresh token metadata is not currently a documented or officially supported feature in FusionAuth. Its presence is inconsistent across authentication flows, as you've observed — it appears for some authentication types but not others (notably absent for MFA + PASSWORD flows).

According to the official documentation, the only documented fields within refresh token metaData are:

metaData.device — An object containing device information (name, type, description, lastAccessedAddress, lastAccessedInstant) metaData.scopes — An array of OAuth scopes associated with the token metaData.resources — An array of resource URIs per RFC 8707 (available since v1.67.0)

The data sub-object with auth_time and authentication_type that you're observing is not part of the documented API contract. Because this is undocumented behavior, you should not rely on it in production code, as it may change or be removed in future versions without notice.

Important Distinction: auth_time on JWTs vs Refresh Tokens

Note that auth_time is a standard and documented claim on access tokens and ID tokens (the JWTs themselves), where it represents the time of initial authentication. However, it is not a documented field on the refresh token record itself when queried via the retrieval API.

Related Documentation Retrieve Refresh Tokens API — Official API documentation including the complete response body structure for refresh tokens Access Token and ID Token Claims — Where auth_time is officially documented as a JWT claim Multi-Factor Authentication (MFA) — Guide to implementing MFA in FusionAuth JWT Refresh API — How to use refresh tokens to obtain new access tokens

Topics tagged with metadata

Is `auth_time` in refresh token metadata reliable for MFA + PASSWORD flows?