JWT Refresh Token – Complete Implementation

How refresh token flow works

1. User logs in → server returns access token (short‑lived) + refresh token (long‑lived).
2. Access token expires → client sends refresh token to /refresh endpoint.
3. Server validates refresh token, issues new access token.
4. Refresh token can be rotated (old one invalidated after use).

C# example

// Generate refresh token (GUID)
var refreshToken = Convert.ToBase64String(Guid.NewGuid().ToByteArray());

// Store in database (hashed) with user ID and expiration

// Endpoint to refresh
[HttpPost("refresh")]
public IActionResult Refresh(string refreshToken)
{
    var storedToken = _db.RefreshTokens.FirstOrDefault(rt => rt.Token == refreshToken);
    if (storedToken == null || storedToken.Expires < DateTime.UtcNow)
        return Unauthorized();

    var newAccessToken = GenerateJwtToken(storedToken.UserId);
    return Ok(new { accessToken = newAccessToken });
}