API v1 · OAuth
refresh_token_reuse
| HTTP | When |
|---|---|
| 400 | The refresh token was already used — the token family has been revoked. |
Refresh tokens are single-use. Presenting one that was already rotated is treated as a leaked-token signal: the whole family is revoked and the user must consent again. The one exception is the immediately previous token presented again by the same client within 5 minutes of its rotation, before its replacement was used — that returns a fresh token pair instead.
If your client crashed between receiving a new refresh token and
persisting it, this is the expected recovery path — send the user
through /authorize again. See
OAuth §4.1.