Change in OAuth Sandbox Refresh‑Token Rotation Policy When Reusing Test Clients Concurrently

Answer

In the sandbox environment the provider issues a new refresh token on every token request and immediately invalidates the previously issued refresh token. When the same test client credentials are used in parallel authentication flows, the second flow’s token request causes the first flow’s refresh token to become invalid, so any later refresh attempt using that original token fails with invalid_grant.

Confirmed Facts (from research)

• The sandbox now enforces refresh‑token rotation for every token issuance.
• Using the same test client identifier in concurrent flows invalidates the first flow’s refresh token as soon as the second flow obtains a new token.
• This change aligns with OAuth 2.0 Best Current Practice recommendations for refresh‑token rotation and was introduced to mitigate replay‑attack risks in the sandbox.
• The policy applies only to the sandbox; production endpoints continue to allow non‑rotating refresh tokens unless explicitly configured otherwise.

Likely Explanation

The provider adopted mandatory refresh‑token rotation to prevent token replay attacks in the test environment. By invalidating the old token as soon as a new one is issued, any intercepted or reused token becomes useless, which improves sandbox security but requires test suites to handle token state carefully.

Steps to Verify the Behavior

1. Obtain a client ID and secret for the sandbox test client.
2. Make a token‑refresh request (using a valid refresh token) and capture the response; verify that it contains a refresh_token field.
3. Immediately attempt a second refresh request using the original refresh token from step 1; expect an error response with invalid_grant.
4. To test concurrency, launch two simultaneous refresh requests using the identical client credentials:
   • The first request should succeed and return a new refresh token.
   • The second request should also succeed (it receives its own new token).
   • Any subsequent refresh attempt using the token from the first request will fail with invalid_grant.
5. Record the responses and confirm that the old token is no longer accepted after any new token is issued.

What to Ask If Uncertain

If you are unsure whether your sandbox instance has adopted this rotation policy, ask for the sandbox version or release notes that mention ‘refresh‑token rotation enforced for test clients’. Knowing the exact version will confirm whether the described behavior is in effect.