🔐
AB-142

Refresh token rotation supported

🔐 Bot Authentication Moderate effort Est. cost: $0

What it means

Your OAuth metadata includes refresh_token in grant_types_supported (optional).

Why it matters

Refresh token rotation lets agents maintain long-running sessions without re-authenticating, while each refresh issues a new token — limiting replay window.

What's wrong

grant_types_supported: ['client_credentials']

What's right

grant_types_supported: ['client_credentials', 'refresh_token']

Check this rule on your site

Enter your URL to check just this one rule (AB-001).

Related rules in Bot Authentication