<![CDATA[Is `auth_time` in refresh token metadata reliable for MFA + PASSWORD flows?]]>When querying the refresh token endpoint GET /api/jwt/refresh?userId={userId}, some refresh tokens include a data sub-object under metaData containing fields like auth_time and authentication_type.

This metadata appears to be present for the following authentication types:

  • PASSWORD
  • PASSWORDLESS
  • SAMLv2IdpInitiated
  • SAMLv2

However, when users authenticate using MFA + PASSWORD, the data sub-object is missing from the refresh token metadata.

Is this data object (specifically auth_time and authentication_type) something that can be reliably used across all authentication flows in current and future versions of FusionAuth? Or is its presence inconsistent and not intended as a stable API feature?

]]>https://fusionauth.io/community/forum/topic/3349/is-auth_time-in-refresh-token-metadata-reliable-for-mfa-password-flowsRSS for NodeSat, 07 Nov 2026 08:15:53 GMTThu, 05 Nov 2026 19:02:58 GMT60<![CDATA[Reply to Is `auth_time` in refresh token metadata reliable for MFA + PASSWORD flows? on Fri, 06 Nov 2026 20:55:50 GMT]]>The data sub-object containing auth_time and authentication_type in refresh token metadata is not currently a documented or officially supported feature in FusionAuth. Its presence is inconsistent across authentication flows, as you've observed — it appears for some authentication types but not others (notably absent for MFA + PASSWORD flows).

According to the official documentation, the only documented fields within refresh token metaData are:

  • metaData.device — An object containing device information (name, type, description, lastAccessedAddress, lastAccessedInstant)
  • metaData.scopes — An array of OAuth scopes associated with the token
  • metaData.resources — An array of resource URIs per RFC 8707 (available since v1.67.0)

The data sub-object with auth_time and authentication_type that you're observing is not part of the documented API contract. Because this is undocumented behavior, you should not rely on it in production code, as it may change or be removed in future versions without notice.

Important Distinction: auth_time on JWTs vs Refresh Tokens

Note that auth_time is a standard and documented claim on access tokens and ID tokens (the JWTs themselves), where it represents the time of initial authentication. However, it is not a documented field on the refresh token record itself when queried via the retrieval API.

Related Documentation

]]>https://fusionauth.io/community/forum/post/9038https://fusionauth.io/community/forum/post/9038Fri, 06 Nov 2026 20:55:50 GMT