OAuth Refresh Token Rotation for Public Clients

Public clients cannot protect long-lived secrets. Rotation and reuse detection are non-negotiable.

Core Controls

1. PKCE for authorization code flow.
2. Short-lived access tokens.
3. One-time-use refresh tokens.

{
  "access_token_ttl": 900,
  "refresh_rotation": true,
  "reuse_detection": true
}

Design the token lifecycle assuming compromise, not best behavior.