> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Online Refresh Tokens

> Learn about Online Refresh Tokens.

export const ReleaseStageNotice = ({feature, stage, plans, contact, terms}) => {
  const stageTextMap = {
    "beta": "Beta",
    "ea": "Early Access"
  };
  const stageText = stageTextMap[stage] || "a product release stage";
  const prsLink = "/docs/troubleshoot/product-lifecycle/product-release-stages";
  const linkify = (text, url) => {
    return <a href={url} target="_blank" rel="noreferrer" class="link">{text}</a>;
  };
  const includeDetails = (plans, contact, terms) => {
    const hasDetails = terms || plans || contact;
    if (!hasDetails) return null;
    return <span data-as="p">
            {plans && <>This feature is available for {linkify(`${plans} plans`, "https://auth0.com/pricing")}. </>}
            {contact && "To participate, contact " + contact + ". "}
            {terms && <>By using this feature, you agree to the applicable Free Trial terms in Okta's {linkify("Master Subscription Agreement", "https://www.okta.com/legal")}.</>}
        </span>;
  };
  return <Warning>
            <span data-as="p">
                <strong>The {feature} feature is in {linkify(stageText, prsLink)}.</strong>
            </span>

            {includeDetails(plans, contact, terms)}
        </Warning>;
};

<ReleaseStageNotice feature="Online Refresh Tokens" stage="beta" contact="your Technical Account Manager" />

Online Refresh Tokens (ORTs) are a type of [refresh token](/docs/secure/tokens/refresh-tokens) designed specifically for browser-based applications, such as [single-page applications](/docs/get-started/auth0-overview/create-applications/single-page-web-apps) (SPAs).

ORTs can keep track of a user's session in SPAs when browser privacy features like Intelligent Tracking Prevention (ITP) block access to third-party cookies, making traditional [silent authentication](/docs/authenticate/login/configure-silent-authentication#configure-silent-authentication) unreliable.

ORTs are bound to the user's Auth0 [session](/docs/manage-users/sessions) and can only be used while that session is active, ensuring that when a user logs out all applications using that session are logged out together.

## How it works

When you request an ORT:

1. Your application includes the `online_access` scope in the authorization request.
2. Auth0 returns an ORT bound to the user's current session.
3. Each time you exchange the ORT for a new access token, Auth0 extends the session's idle timeout.
4. The token remains valid as long as the underlying Auth0 session is active.

## Comparison of ORTs versus refresh tokens

| **Feature**                                                                                                                             | **ORTs**                                                                                                       | **refresh token**                                                                                  |
| --------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| **Scope requested**                                                                                                                     | `online_access`                                                                                                | `offline_access`                                                                                   |
| **Session binding**                                                                                                                     | Bound to Auth0 session                                                                                         | Independent of session                                                                             |
| **Lifetime**                                                                                                                            | Determined by [session lifetime](/docs/manage-users/sessions/configure-session-lifetime)                       | Configured [token lifetime](/docs/secure/tokens/refresh-tokens/configure-refresh-token-expiration) |
| **Token rotation**                                                                                                                      | Does not rotate                                                                                                | Supports [rotation](/docs/secure/tokens/refresh-tokens/configure-refresh-token-rotation)           |
| **[Demonstration of Proof of Possession](/docs/secure/sender-constraining/demonstrating-proof-of-possession-dpop)  (DPoP) requirement** | Required for public clients (SPA, Native)                                                                      | Optional (resource server config)                                                                  |
| **Revocation**                                                                                                                          | [Revokes the entire session](/docs/manage-users/sessions/manage-sessions-actions#revoke-sessions-with-actions) | [Revokes only the token](/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens)                 |
| **Management API**                                                                                                                      | Not visible                                                                                                    | Visible via the Management API                                                                     |
| **Session idle timeout**                                                                                                                | Extended on each exchange                                                                                      | No effect on session                                                                               |

### Key behavioral differences

**Session extension:** When you exchange an ORT, Auth0 resets the session idle timeout, keeping the user session alive. Auth0 does not extend the session's [absolute lifetime](/docs/manage-users/sessions/session-lifecycle#absolute-timeout-maximum).

**DPoP enforcement:** For public clients (such as SPAs), Auth0 requires DPoP when using ORTs. Because ORTs operate at the same security level as a session cookie granting access to the user's authenticated session, they must be protected with the same rigor. DPoP prevents token theft and replay attacks.

**Stateless:** ORTs are bound to a session, so they cannot be seen or managed independently. You cannot see them in the Management API or revoke them individually.

## Best practices

1. **Store tokens in memory:** Avoid storing ORTs in `localStorage` or `sessionStorage`. Keep them in JavaScript memory for better security. Since ORTs are bound to the Auth0 session, the session cookie will re-establish context on the user's next visit, allowing your app to request a fresh ORT.
2. **Handle session expiration gracefully:** Implement proper error handling for cases when the session has expired. Redirect users to re-authenticate without losing their work.
3. **Use DPoP for public clients:** ORTs require DPoP for public clients. Ensure your implementation generates and uses DPoP proofs correctly.
4. **Do not rely on token structure:** Treat ORTs as opaque strings. Don't parse or rely on any internal structure—this may change.
5. **Monitor session lifetime:** Be aware of both idle and absolute session timeouts. The absolute timeout cannot be extended via refresh token exchange.

## Limitations

### Unsupported flows

ORTs are only available for flows that create an interactive browser session. The following flows **cannot** issue ORTs:

| **Flow**                                                                                                              | **Reason**                                                 |
| --------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
| [Device Authorization Flow](/docs/get-started/authentication-and-authorization-flow/device-authorization-flow)        | Session created in browser, token used on different device |
| [Implicit Flow](/docs/get-started/authentication-and-authorization-flow/implicit-flow-with-form-post)                 | OAuth spec prohibits refresh tokens in implicit flow       |
| [Resource Owner Password Grant](/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow) | No browser session is created                              |
| [Client Credentials Flow](/docs/get-started/authentication-and-authorization-flow/client-credentials-flow)            | No user or session involved                                |
| [Custom Token Exchange](/docs/get-started/authentication-and-authorization-flow/token-exchange-flow)                  | No session to bind the token to                            |

If you request `online_access` scope in any of these flows, the scope is silently ignored and no refresh token is issued.

### Scope conflicts

You cannot request both `online_access` and `offline_access` in the same authorization request. If both scopes are included, Auth0 returns an error:

```json theme={null}
{
  "error": "invalid_request",
  "error_description": "Cannot request both online_access and offline_access scopes"
}
```

Select the appropriate scope based on your use case:

* Use `online_access` for browser-based applications that benefit from SSO continuity.
* Use `offline_access` for applications that need tokens to work independently of the browser session.

## Learn more

* [Configure Online Refresh Tokens](/docs/secure/tokens/refresh-tokens/online-refresh-tokens/configure-online-refresh-tokens)
* [Refresh Token Rotation](/docs/secure/tokens/refresh-tokens/refresh-token-rotation)
* [Get Refresh Tokens](/docs/secure/tokens/refresh-tokens/get-refresh-tokens)
* [Use Refresh Tokens](/docs/secure/tokens/refresh-tokens/use-refresh-tokens)
* [Session Lifecycle](/docs/manage-users/sessions/session-lifecycle)
* [Configure Silent Authentication](/docs/authenticate/login/configure-silent-authentication)
* [Token Best Practices](/docs/secure/tokens/token-best-practices)