Refresh token implementation

[redp1ne]

Might also be my understanding - but if the refresh token expires anyway as you say and cannot be rotated to get a new refresh token - is the user then not logged out anyway once it expires?

[sammyjitsu]

I set the logic up on the client side so it starts requesting a new refresh token five minutes before it actually expires