Glossary

Refresh token rotation

Issuing a new refresh token every time one is used, so a stolen old one stops working.

Also called

offline_access

At OneLifeVibe

• With offline_access, OneLifeVibe issues refresh tokens that are rotated (single use), stay valid for 30 days of inactivity and 90 days at most, and survive the person signing out of the websites. Without offline_access, a refresh token ends with the person's OneLifeVibe session.
• The person can remove an assistant under Applications in their account, or the assistant can revoke its refresh token at the revoke endpoint.

Related terms

• OAuth scopes
• Access token audience (aud)