Skip to Content
Security modelToken handling

Token handling

Access tokens, refresh tokens, client secrets and introspection credentials are bearer authority or server credentials. Keep them in trusted server or platform-protected storage.

Browser applications

  • keep OAuth tokens in the BFF;
  • expose only an HttpOnly, Secure, SameSite application-session cookie;
  • refresh before expiry on the server;
  • persist refresh-token rotation before continuing the request;
  • revoke the refresh token during product logout where possible.

Native applications

  • keep tokens in platform secure storage;
  • never log tokens or include them in crash metadata;
  • use Authorization Code with PKCE;
  • treat a failed refresh as a session transition, not as a reason to replay credentials silently.

Backend credentials

Introspection credentials are issued once and bound to a tenant resource. Store them in the server’s secret manager. Rotation means issuing a replacement, deploying it, verifying use and then disabling the old credential.

Authentication and MFAThreat boundaries