API v1 · OAuth
refresh_token_reuse
| HTTP | When |
|---|---|
| 400 | The refresh token was already used — the token family has been revoked. |
Refresh tokens are single-use. Presenting one that was already rotated (outside the 15-second network-retry grace window) is treated as a leaked-token signal: the whole family is revoked and the user must consent again.
If your client crashed between receiving a new refresh token and
persisting it, this is the expected recovery path — send the user
through /authorize again. See
OAuth §4.1.