<![CDATA[Compatibility of refresh token settings: sliding window and one-time use]]>If you have one-time use refresh token, then every time it is used, you get a new refresh token.

If you have a refresh token with a sliding window, every time you use it, its lifetime is extended.

How are these settings compatible?

]]>https://fusionauth.io/community/forum/topic/2800/compatibility-of-refresh-token-settings-sliding-window-and-one-time-useRSS for NodeThu, 08 Oct 2026 13:50:53 GMTThu, 21 Nov 2024 15:49:53 GMT60<![CDATA[Reply to Compatibility of refresh token settings: sliding window and one-time use on Thu, 21 Nov 2024 15:53:00 GMT]]>It's a subtle difference, but one-time use refers to the value of the refresh token, which you use against the /oauth2/token endpoint to get a new access token via the refresh grant.

A sliding window refers to the refresh token itself, which has a unique id which stays the same, even as the value of the refresh token changes.

So if you had a refresh token with a lifetime of 4 hours, a sliding window and one time use configured, you might end up with something like this:

  • at creation: id 09cfb961-291a-420f-b5cf-48c5c87a67cc, value RNhY5yE39t1o2FXKxgyH, lifetime 4 hours
  • when the RT is presented to the /oauth2/token endpoint 3 hours after creation: id 09cfb961-291a-420f-b5cf-48c5c87a67cc, value Fh95KZLfSMjMNxpR5B4c, lifetime 4 more hours
  • when the RT is presented to the /oauth2/token endpoint 3 hours later: id 09cfb961-291a-420f-b5cf-48c5c87a67cc, value baHneP4s0hBHPEk88GPC, lifetime 4 more hours

More details here: https://github.com/FusionAuth/fusionauth-issues/issues/2925

]]>https://fusionauth.io/community/forum/post/7620https://fusionauth.io/community/forum/post/7620Thu, 21 Nov 2024 15:53:00 GMT