# OAuth rotating tokens: Unknown or invalid refresh token

**URL:** <https://community.developer.atlassian.com/t/oauth-rotating-tokens-unknown-or-invalid-refresh-token/54555>\
**Category:** Jira Cloud\
**Tags:** oauth2, confluence-cloud, jira-cloud, rest-api\
**Created:** [December 18, 2021, 4:37pm UTC](https://community.developer.atlassian.com/t/oauth-rotating-tokens-unknown-or-invalid-refresh-token/54555 "2021-12-18T16:37:04Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![szn](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/szn/32/40950_2.png) [@szn](https://community.developer.atlassian.com/u/szn)\
**Post date:** [December 21, 2021, 1:57pm UTC](https://community.developer.atlassian.com/t/oauth-rotating-tokens-unknown-or-invalid-refresh-token/54555/6 "2021-12-21T13:57:40Z")

</div>

Thanks again for your quick response.

I am actually doing:

```js
if (response.refresh_token)
  user.refreshToken = response.refresh_token

```

This handles missing, null and empty `refresh_token`. But it is not helping.

Despite a single env. app I do have concurrent token refreshes. A user can place a number of my macros on a Confluence page. If she/he opens the page, I am receiving number of concurrent requests that I have to handle in parallel. But, as I believe(d), with the allowed reuse interval set to 10 minutes, and the `if` statement above this should not be a problem. All these concurrent requests are handled in less than 2 seconds.

What I can do is to save not only the newly received refresh\_token but also the response timestamp. Then, I should only overwrite the refresh token if it was delivered later than the one I have in DB.

I was also trying to go back to the permanent refresh token in the OAuth app settings. It was successful in my dev app. Production app throws a very useful “Something went wrong” error message while trying to save this setting.

Anyhow, seems that the root cause is here:

> [@Superseded: 31 January 2022 - Action required - Deprecating persistent refresh tokens](https://community.developer.atlassian.com/t/superseded-31-january-2022-action-required-deprecating-persistent-refresh-tokens/50348/60):
>
> Hey @KevinGreenan and @FatmehShuman, sorry for keeping you waiting! I wanted to make sure I give you a complete reply. Following your comments we checked our rotating refresh tokens (RRT) config and found that it didn’t match the behaviour we described, nor the one we were going for. This config mistake on our end was what led to your experience, but again, it wasn’t intended. This also prompted us to conduct a quick review of our RRT settings and finally we agreed on the following as a balance…

And before they fix that we will continue to have problems at least once per month.

---

_[View the full topic](https://community.developer.atlassian.com/t/oauth-rotating-tokens-unknown-or-invalid-refresh-token/54555)._