Users can sign in but token refresh is failing after a while. What should I check?

If users can sign in but refresh starts failing later, I’d check these first:

1) Refresh token lifetime / expiration

• Confirm the refresh token is still valid when refresh is attempted.
• Check whether the app is using:
  • access token expiry too aggressively
  • refresh tokens with a short TTL
  • rotating refresh tokens where the old one is invalidated after use

2) Clock skew / time sync

• If server and client clocks are off, tokens may appear expired early.
• Check:
  • server time
  • container/VM time
  • browser/device time if validation depends on it

3) Refresh token storage and retrieval

• Make sure the refresh token is being saved and sent correctly:
  • cookie vs local storage vs memory
  • cookie attributes: HttpOnly, Secure, SameSite, Domain, Path
• If using cookies, verify the browser is actually including them on the refresh request.

4) Refresh endpoint behavior

• Look at the response from the refresh endpoint:
  • 401/403 = auth/session issue
  • 400 = malformed request or invalid token
  • 429 = rate limiting
  • 5xx = backend failure
• Check whether the refresh endpoint expects a header, cookie, or request body field that may not be present.

5) Token rotation / revocation logic

• If refresh tokens are rotated, confirm the client is storing the new refresh token after each refresh.
• If not, the next refresh will fail because the old token was invalidated.
• Also check whether logout, password change, or security policies are revoking sessions unexpectedly.

6) Session / IdP configuration

If you’re using an identity provider:

• session duration
• refresh token policy
• offline access / offline_access scope
• consent requirements
• tenant/app config changes

7) Browser privacy / cookie blocking

• Third-party cookie restrictions can break refresh flows.
• Common in:
  • embedded apps
  • cross-site auth domains
  • Safari/Firefox stricter tracking protection
• Verify if the auth cookie is first-party or third-party.

8) Client refresh logic

• Check for bugs in the refresh code:
  • not updating the in-memory token
  • multiple concurrent refresh requests causing invalidation
  • retry loops using an old token
  • using the access token instead of refresh token by mistake

9) Backend logs and audit events

• Check auth server logs for:
  • invalid_grant
  • token expired
  • token revoked
  • reuse detected
  • signature invalid
• These often point directly to the cause.

Quick way to narrow it down

Ask:

1. How long after sign-in does refresh fail?
2. What exact error is returned?
3. Is the refresh token rotated?
4. Are tokens stored in cookies or local storage?
5. Did anything change in auth config, domain, or browser behavior?

If you want, I can help you debug this more specifically if you share:

• your auth provider (Auth0, Cognito, Keycloak, custom, etc.)
• whether refresh token is in a cookie or response body
• the exact error from the refresh request.