<commit_before>---
description: Learn how to configure Refresh Token rotation.
topics:
  - tokens
  - refresh-tokens
  - refresh-token-rotation
contentType: how-to
useCase:
  - enable-refresh-token-rotation
  - configure-refresh-token-rotation
---
# Configure Refresh Token Rotation

Configure Refresh Token Rotation for each application using the Dashboard or the Management API. When Refresh Token Rotation is enabled, the transition for the end-user is seamless. The application uses the previous non-rotating Refresh Token which has expired and swaps it for a rotating Refresh Token. 

Migration scenarios accommodate automatic token revocation when migrating from a non-rotating Refresh Token to a rotating Refresh Token and vice-versa.

- Exchanging a non-rotating Refresh Token when Refresh Token Rotation is enabled deletes all the non-rotating tokens issued for the same `client_id`, resource server, and user and tenant.
- Exchanging a rotating Refresh Token when Refresh Token Rotation is disabled issues a non-rotating Refresh Token and revokes the Rotating Refresh Token family.

## Using the Dashboard

1. Go to [Dashboard > Application Settings](${manage_url}/#/applications). Scroll to the **Application Tokens** section. Set **Refresh Token Behavior** to **Rotating**. 

    ![Application Token Settings - Rotating Refresh Tokens](/media/articles/tokens/rotating-tokens.png)

2. Set **Refresh Token Lifetime (Absolute)** for when a Refresh Token will expire in seconds. 

    The Refresh Token lifetime is the *absolute* lifetime that Refresh Tokens can be used to get new Access Tokens, after which time, the user has to re-authenticate. The default Refresh Token expiration period is 30 days (2592000 seconds). You can configure up to 90 days (7776000 seconds). *The lifetime does not extend when tokens are rotated.* 

3. Set **Refresh Token Reuse Interval** to allow a reuse interval for a Refresh Token to account for lag between request and response time due to the end-user's network, device, and/or location (in seconds). 

4. Click **Save Changes**.

## Using the Management API

You can also use the Managment API to enable Refresh Token rotation:

1. Install the latest version of the `auth0-spa-js` SDK.

    ```text
    npm install @auth0/auth0-spa-js
    ```
<commit_msg>Clarify the Refresh Token Rotation opt in requirements.<commit_after>---
description: Learn how to configure Refresh Token rotation.
topics:
  - tokens
  - refresh-tokens
  - refresh-token-rotation
contentType: how-to
useCase:
  - enable-refresh-token-rotation
  - configure-refresh-token-rotation
---
# Configure Refresh Token Rotation

Configure Refresh Token Rotation for each application using the Dashboard or the Management API. When Refresh Token Rotation is enabled, the transition for the end-user is seamless. The application uses the previous non-rotating Refresh Token which has expired and swaps it for a rotating Refresh Token. 

Migration scenarios accommodate automatic token revocation when migrating from a non-rotating Refresh Token to a rotating Refresh Token and vice-versa.

- Exchanging a non-rotating Refresh Token when Refresh Token Rotation is enabled deletes all the non-rotating tokens issued for the same `client_id`, resource server, and user and tenant.
- Exchanging a rotating Refresh Token when Refresh Token Rotation is disabled issues a non-rotating Refresh Token and revokes the Rotating Refresh Token family.

## Using the Dashboard

1. Go to [Dashboard > Application Settings](${manage_url}/#/applications). Scroll to the **Application Tokens** section. Set **Refresh Token Behavior** to **Rotating**. 

    ![Application Token Settings - Rotating Refresh Tokens](/media/articles/tokens/rotating-tokens.png)

2. Set **Refresh Token Lifetime (Absolute)** for when a Refresh Token will expire in seconds. 

    The Refresh Token lifetime is the *absolute* lifetime that Refresh Tokens can be used to get new Access Tokens, after which time, the user has to re-authenticate. The default Refresh Token expiration period is 30 days (2592000 seconds). You can configure up to 90 days (7776000 seconds). *The lifetime does not extend when tokens are rotated.* 

3. Set **Refresh Token Reuse Interval** to allow a reuse interval for a Refresh Token to account for lag between request and response time due to the end-user's network, device, and/or location (in seconds). 

4. Click **Save Changes**.

::: warning
Refresh Token Rotation is only supported for OIDC-conformant applications having the Refresh Token grant type enabled.
:::

## Using the Management API

You can also use the Managment API to enable Refresh Token rotation:

1. Install the latest version of the `auth0-spa-js` SDK.

    ```text
    npm install @auth0/auth0-spa-js
    ```

{'fraction_non_alphanumeric': 0.06545378502718528, 'fraction_numerical': 0.010874111250522794, 'mean_word_length': 4.2967884828349945, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '528951', 'n_tokens_mistral': 1286, 'n_tokens_neox': 1205, 'n_words': 630}