Refresh Token
A refresh token is a long-lived OAuth credential used only to obtain new access tokens without asking the user to sign in again. Refresh tokens are highly sensitive: anyone who steals one can mint fresh access tokens until the refresh token is revoked or expires.
Technical Architecture & Deep-Dive
Authorization servers issue short-lived access tokens plus refresh tokens for offline or persistent sessions. Mobile and SPA apps must not store refresh tokens in localStorage or decompilable binaries. The authorization code flow with PKCE keeps refresh exchange on a trusted server or edge worker.
Rotation policies replace each refresh token on use and invalidate reuse attempts, shrinking the window after leakage. Vault refresh tokens alongside provider secrets, log rotations in audit trails, and expose only short-lived client tokens to frontends.
Key Architectural Benefits
Implement Refresh Token at the Edge
Deploy lightweight API aggregation, edge caching, and secret injection in minutes without Docker containers or complex servers.
Frequently Asked Questions
Q:Should refresh tokens ever be sent to a browser SPA?
Avoid it when possible. Prefer a backend-for-frontend or edge proxy that holds the refresh token and returns short-lived access or client tokens to the browser.
Related Architecture Concepts
An access token is a credential that authorizes calls to a protected API on behalf of a user or application. OAuth providers issue access tokens with a limited lifetime and scopes. APIs validate the token signature or call an introspection endpoint before executing the request.
OAuth 2.0 is an authorization framework that lets an application obtain limited access to a user account on another service without handling the user password. The user approves requested scopes, and the application receives an access token it uses to call the service API.
PKCE, short for Proof Key for Code Exchange, is an OAuth 2.0 extension that protects the authorization code flow for public clients like mobile apps and single-page applications. The client sends a hashed code challenge, then proves possession of the original verifier when exchanging the code for tokens.
Token introspection is an OAuth 2.0 mechanism where a resource server asks the authorization server whether an opaque access token is active, which scopes it carries, and which subject it represents. The introspection endpoint returns a structured active or inactive verdict.
Ready-to-Use Edge Recipes
You should not store Salesforce credentials in React client code. Vault-inject OAuth or integration tokens at the edge; React calls one public client token URL. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To solve call clerk backend api from client side, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.
You should not store Salesforce credentials in JavaScript / HTML client code. Edge pipeline attaches Bearer tokens so static sites never embed secrets. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.