> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging-quickstart-revamp.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> Learn how to manage refresh tokens with the Auth0 Management API.

# Manage Refresh Tokens with Auth0 Management API

Auth0 issues a <Tooltip tip="Refresh Token: Token used to obtain a renewed Access Token without forcing users to log in again." cta="View Glossary" href="/docs/glossary?term=refresh+token">refresh token</Tooltip> as a credential artifact that your application can use to get a new <Tooltip tip="Refresh Token: Token used to obtain a renewed Access Token without forcing users to log in again." cta="View Glossary" href="/docs/glossary?term=access+token">access token</Tooltip> without user interaction. This allows Auth0 to shorten the access token lifetime for security purposes without involving the user when the access token expires.

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  The Auth0 Management API refresh token endpoints are currently are available to customers on Enterprise plans. To learn more, read [Pricing](https://auth0.com/pricing).
</Callout>

## Management API endpoints

The Auth0 <Tooltip tip="Management API: A product to allow customers to perform administrative tasks." cta="View Glossary" href="/docs/glossary?term=Management+API">Management API</Tooltip> provides endpoints to manage refresh tokens individually or as a collection.

These endpoints complement [alternative refresh-token revocation](/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens), superseding the `device-credentials` resource endpoints with extended properties and bulk revocation operations.

### Refresh Token resource

You can view or revoke a specific refresh token with the following endpoints:

<table class="table">
  <thead>
    <tr>
      <th><strong>Name</strong></th>
      <th><strong>URL</strong></th>
      <th><strong>Required scope(s)</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>View a refresh token information by ID</td>
      <td><code>GET /api/v2/refresh-tokens/{tokenId}</code></td>
      <td><code>read:refresh\_tokens</code></td>
    </tr>

    <tr>
      <td>Revoke a refresh token by ID</td>
      <td><code>DELETE /api/v2/refresh-tokens/{tokenId}</code></td>
      <td><code>delete:refresh\_tokens</code></td>
    </tr>
  </tbody>
</table>

### User resource

You can list or revoke all refresh tokens for a given user with the following endpoints:

<table class="table">
  <thead>
    <tr>
      <th><strong>Name</strong></th>
      <th><strong>URL</strong></th>
      <th><strong>Required scope(s)</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>List all refresh tokens for a user</td>
      <td><code>GET /api/v2/users/{userId}/refresh-tokens</code></td>
      <td><code>read:refresh\_tokens</code></td>
    </tr>

    <tr>
      <td>Revoke all refresh tokens for a user</td>
      <td><code>DELETE /api/v2/users/{userId}/refresh-tokens</code></td>
      <td><code>delete:refresh\_tokens</code></td>
    </tr>
  </tbody>
</table>

## Refresh token properties

The refresh <Tooltip tip="Token Endpoint: Endpoint on the Authorization Server that is used to programmatically request tokens." cta="View Glossary" href="/docs/glossary?term=token+endpoints">token endpoints</Tooltip> return relevant information about the token and its history.

<table class="table">
  <thead>
    <tr>
      <th><strong>Field</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Refresh Token ID</td>
      <td>A unique and tenant-specific identifier of the refresh token in the API. It is not the token itself, which is a secret to exchange with the token endpoint in the authentication API.<br /><br />Refresh tokens can outlive a session. The refresh token keeps this information regardless of the session lifecycle.</td>
    </tr>

    <tr>
      <td>Session ID</td>
      <td>The session ID is a persistent identifier of the session in the Auth0 tenant. Note that the session ID corresponds to the <code>sid</code> claim already in ID Tokens and Logout Tokens and can be used to cross-reference these entities.<br /><br />The refresh token contains references to the session that was used to create the token. The session ID can be used to retrieve additional information with the Management API <a href="/docs/manage-users/sessions/manage-user-sessions-with-auth0-management-api">introspect a specific session by ID</a> endpoint.</td>
    </tr>

    <tr>
      <td>Relevant Time</td>
      <td>Refresh token creation, and expiry information.</td>
    </tr>

    <tr>
      <td>Client and Resource Servers Information</td>
      <td>Summary information about the applications and APIs bound to a refresh token.</td>
    </tr>
  </tbody>
</table>

## Limitations

* Refresh token revocation (`DELETE`) operations run asynchronously, and are eventually consistent.
* Refresh tokens issued on or after 21-09-2023 (22-02-2024 for tenants in the US-3 region) contain the session ID (`session_id`) property with the appropriate value. Refresh tokens issued before this date contain this property with a `null` value.

## Learn more

* [Refresh Tokens](/docs/secure/tokens/refresh-tokens)
* [Revoke Refresh Tokens](/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens)
* [Use Refresh Tokens](/docs/secure/tokens/refresh-tokens/use-refresh-tokens)