Refresh tokens rotate on every use, reuse of a spent token revokes the entire token family, and access tokens issued after detection are invalid, following RFC 6749 grant rules and OAuth 2.0 Security BCP reuse guidance.
게시일 Sep 12, 2026
NOASSERTION · Published Sep 12, 2026