Skip to main content

Token Lifecycle

Summary​

Identity issues an access token and refresh token after successful login, rotates the refresh token during renewal, and revokes refresh tokens during logout or all-device logout.

Audience​

  • Implementation and support teams
  • Developers and QA engineers
  • DevOps engineers
  • Solution architects and security engineers

Purpose​

The token lifecycle allows short-lived API authentication to be renewed while retaining server-side control over refresh credentials and associated device sessions.

Architecture​

Business concepts​

  • Token issuance follows successful authentication.
  • Access tokens authenticate API requests until they are no longer valid.
  • Refresh tokens support renewal without resubmitting the password.
  • Rotation replaces a used refresh token with a newly persisted token.
  • Revocation prevents a stored refresh token from being accepted again.
  • Logout-all revokes all active refresh tokens and sessions for the user.

Technical implementation​

Refresh credentials are generated using a cryptographic random source and stored only as hashes. Refresh processing loads currently valid, non-revoked records, verifies the presented token against a stored hash, confirms that the user is active, and rejects a revoked device session.

On successful refresh, the prior record is marked revoked and linked conceptually to its replacement. The associated device session’s last-seen time is updated, and a token-refreshed security event is recorded.

This page does not publish token lifetimes, remember-me durations, signing details, configuration identifiers, or secret values.

Confirmed source references​

  • microservices/src/identity-service/Application/Auth/IdentityAuthService.cs
  • microservices/src/identity-service/Application/Security/IdentityRefreshTokenService.cs
  • microservices/src/identity-service/Domain/Entities/RefreshToken.cs
  • microservices/src/identity-service/Domain/Entities/DeviceSession.cs
  • microservices/src/identity-service/Program.cs

See Also​

Keywords​

  • Refresh-token rotation
  • Token renewal
  • Token revocation

Revision Information​

  • Last reviewed: 2026-07-14
  • Owner: identity-team
  • Status: Draft