# Refreshing an access token

**URL:** <https://devforum.okta.com/t/refreshing-an-access-token/11336>\
**Category:** Questions\
**Created:** [October 12, 2020, 8:50pm UTC](https://devforum.okta.com/t/refreshing-an-access-token/11336 "2020-10-12T20:50:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cat](https://avatars.discourse-cdn.com/v4/letter/c/d07c76/32.png) [@cat](https://devforum.okta.com/u/cat)\
**Post date:** [October 12, 2020, 8:50pm UTC](https://devforum.okta.com/t/refreshing-an-access-token/11336/1 "2020-10-12T20:50:40Z")

</div>

According to the spec [https://tools.ietf.org/html/rfc6749#section-6](https://tools.ietf.org/html/rfc6749#section-6) “The authorization server MAY issue a new refresh token, in which case the client MUST discard the old refresh token and replace it with the new refresh token. The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client.”

It appears that in my Okta tenant, I am NOT getting back a new refresh token when I use the refresh\_token grant type to get a new access token from the /token endpoint. Is this the default behavior of Okta? Is it configurable somewhere in the admin portal?

---

<div class="post-metadata">

**Author:** ![vijet](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/vijet/32/245_2.png) [@vijet](https://devforum.okta.com/u/vijet)\
**Post date:** [October 12, 2020, 9:40pm UTC](https://devforum.okta.com/t/refreshing-an-access-token/11336/2 "2020-10-12T21:40:08Z")

</div>

Hi @cat,

The key word in the spec is “MAY”. It’s not a “MUST”.  
Okta doesn’t generate a new refresh token each time the /token endpoint is called.  
The default and only behavior currently is to use the same refresh token until it expires.

---

<div class="post-metadata">

**Author:** ![cat](https://avatars.discourse-cdn.com/v4/letter/c/d07c76/32.png) [@cat](https://devforum.okta.com/u/cat)\
**Post date:** [October 12, 2020, 10:42pm UTC](https://devforum.okta.com/t/refreshing-an-access-token/11336/3 "2020-10-12T22:42:08Z")

</div>

@vijet Sounds good, thank you for clarifying! I think that should be called out in the documentation 😉

---

<div class="post-metadata">

**Author:** ![vijet](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/vijet/32/245_2.png) [@vijet](https://devforum.okta.com/u/vijet)\
**Post date:** [October 13, 2020, 3:56am UTC](https://devforum.okta.com/t/refreshing-an-access-token/11336/4 "2020-10-13T03:56:25Z")

</div>

Thank you for pointing it out. We will update the documentation 🙂

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [October 14, 2020, 3:56am UTC](https://devforum.okta.com/t/refreshing-an-access-token/11336/5 "2020-10-14T03:56:34Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.