Robert Clapp(@RobertClapp):Rotating refresh tokens without reuse detection leaves downstream API keys exposed when a compromised token keeps minting sessions. refresh tokens are marked spent with a short grace period for network retries, but presenting a spent token after grace revokes the entire token family and logs a refresh_token_reuse audit row. deriving replacement JTIs directly from parent tokens blocks concurrent token tree forks. deriving child JTIs directly from the parent and revoking the entire token family on replay locks down downstream API keys at the auth boundary.

2026.10.25 13:35

Rotating refresh tokens without reuse detection leaves downstream API keys exposed when a compromised token keeps minting sessions. refresh tokens are marked spent with a short grace period for network retries, but presenting a spent token after grace revokes the entire token family and logs a refresh_token_reuse audit row. deriving replacement JTIs directly from parent tokens blocks concurrent token tree forks. deriving child JTIs directly from the parent and revoking the entire token family on replay locks down downstream API keys at the auth boundary.