Token Rotation
ELI5 — The Vibe Check
Token Rotation means regularly replacing your tokens with fresh ones. Old token out, new token in. If someone steals your token, it only works for a short time. It's like changing your locks regularly — even if someone copied your key, it won't work next week.
Real Talk
Token rotation is the practice of periodically issuing new tokens and invalidating old ones. For refresh tokens, rotation means each use issues a new refresh token and invalidates the previous one. If a rotated-out token is used, all tokens for that session are revoked (detecting token theft).
When You'll Hear This
"Refresh token rotation means a stolen token can only be used once before it's invalidated." / "We detect token reuse — if a rotated-out refresh token appears, we kill all sessions for that user."
Related Terms
Access Token
An Access Token is your short-lived pass to access an API. It proves you're authenticated and what you're allowed to do.
JWT Security
JWT Security is about not screwing up JSON Web Tokens.
Refresh Token
A Refresh Token is a long-lived secret that gets you new access tokens without re-logging in.