> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ulm.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Refresh Tokens

An OAuth 2.0 refresh token enables a client to get a new access token from the authorization server, in order to replace an existing or typically expired access token. If a client reuses the same access token in repeated requests to the resource server, this can run the risk of that token being intercepted and compromised. Therefore, to minimize exposure, access tokens usually have a short expiry time, on the order of a few minutes.

To obtain a replacement access token, the client submits a special request to the authorization server, and that request includes both the expired access token and the corresponding refresh token. If the request is valid, the authorization server then issues a replacement access token (and optionally, a replacement refresh token). This process wholly invalidates the previously issued access token, even if it had not yet expired. This refresh operation can only be performed once for a given access token, so it is not subject to a replay attack.

Refresh tokens are typically long-lived, on the order of a number of days, but they can also be made to expire. If this occurs, the resource owner must go through another OAuth 2.0 grant flow to issue fresh tokens to the client.

**Note:** During the initial setup, you register your client(s) with Digital Identity Management, and you control the Authorization Grant type, as well as a variety of rules about the tokens your client will request (for example, token expiry length, whether or not to allow refresh tokens, and such).

**Parent topic:**[OAuth 2.0 and OpenID Connect](../topics/oAuth2andOpenIDConnect)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.