Auth0 Refresh Token Not Working
Quick answer
Refresh tokens fail when offline access was not requested, or when a rotated token is reused outside the overlap period (Auth0 then invalidates the token family). Request offline_access and set a Rotation Overlap Period.
Most likely fix: Enable offline access
How to fix it
Try these in order — the most common fix is first.
1. Enable offline access
- Include the offline_access scope in the /authorize request
- Enable Offline Access for your API in its settings
Did this fix it?2. Set a Rotation Overlap Period
- Dashboard > Applications > your application > Settings > Refresh Token Rotation
- Turn on Allow Refresh Token Rotation and enter a Rotation Overlap Period in seconds (the leeway for delay between request and response)
Did this fix it?3. Check the logs
- Monitor reuse events such as ferrt with log streaming to see whether tokens are being replayed
Did this fix it?
Symptoms
Token request returns "invalid_grant: Unknown or invalid refresh token", or users are logged out unexpectedly.
Why it happens
- offline_access scope not requested at /authorize, or Offline Access not enabled for the API
- Already-used refresh token presented again: reuse detection invalidates the whole family (log event ferrt) and the user must re-authenticate
- Token lifetime ended (with rotation the default is 30 days and does not extend on rotation)
This guide also covers
- auth0 refresh token not working
- auth0 invalid_grant
- auth0 token expired
Still not working?
If Auth0 keeps failing, you're not alone. See every Auth0 problem users report or the alternatives people switch to.
Have an app idea? Our small team builds any software: web and mobile apps, games, desktop, AI tools. Price agreed together.
Talk to us