Topic starter
08/02/2026 8:25 pm
TL;DR: Access tokens typically last 15 to 60 minutes while refresh tokens can remain valid for days to months, and both bypass MFA after issuance, according to Obsidian Security. The security problem is not authentication at the login screen, but how long a stolen bearer token can be used without triggering detection.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “Access Token vs Refresh Token: Key Differences Explained”.
By the numbers:
- Typical access token lifetimes range from 15 to 60 minutes, limiting the window for direct abuse.
Key questions
Q: What breaks when refresh token rotation does not include reuse detection?
A: Rotation without reuse detection only shortens exposure on paper.
Q: Why are OAuth tokens risky even when MFA is enforced for users?
A: MFA protects the user login, but OAuth tokens can keep working after the initial approval without repeated user authentication.
Q: How do security teams detect token abuse when login logs look normal?
A: They need behavioural controls that focus on API activity, data volumes, source infrastructure, and access patterns.
Practitioner guidance
- Differentiate token policies by lifetime and purpose Set distinct governance rules for access tokens and refresh tokens, including expiry, rotation, and revocation expectations.
- Enable refresh token rotation Use rotation so each refresh request issues a new token family and invalidates the previous refresh token.
- Monitor behavioural token use Track source network, user agent, access cadence, and unusual resource access for both token types, with tighter thresholds for refresh tokens because abuse often unfolds slowly over weeks.
Bottom line: Bearer tokens bypass MFA after issuance, so the real control problem is post-authentication governance, not just login security.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:32 pm
Bearer-token abuse is a post-authentication governance problem, not an MFA problem. MFA and SSO still matter, but they only protect the login boundary. Once an OAuth token is issued, the security question becomes how long the bearer credential remains useful and how visible its use is to defenders. The implication is that SaaS governance must extend beyond authentication events into token lifecycle and behavioural control.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations prioritise refresh token controls over access token controls?
A: Yes, when the risk is persistent SaaS access. Access tokens matter because they enable immediate misuse, but refresh tokens are usually the more dangerous object because they can sustain access for days or months. The practical priority is to combine both, then give refresh token rotation and behavioural detection the strongest governance focus.
👉 Read our full editorial: Access token vs refresh token risk: why MFA does not help