refresh-token
Articles tagged with refresh-token.
Access Token vs Refresh Token: Key Differences
Access tokens authorize API calls briefly; refresh tokens only obtain new tokens. How they differ, and what Gitea 28.1.0 fixed…
8 min readCVE-2026-93999: Keycloak Refresh Restores a Disabled Audience
Keycloak checks an audience client is enabled during token exchange, but not when that refresh token is used. What CVE-2026-93999…
8 min readRevoke One Keycloak Session Without Logging the User Out Everywhere
Revoke a single Keycloak session or refresh token without ending all of a user's sessions: the logout endpoint, admin session…
9 min readKeycloak Offline Tokens Explained
What Keycloak offline tokens are, how the offline_access scope works, how they differ from regular refresh tokens, and when to…
11 min readKeycloak Refresh Token Rotation: Setup and Best Practices
How to configure refresh token rotation in Keycloak: revoke-on-use, reuse detection, token lifetimes, SPA vs confidential clients, and security best…
11 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.