Topic starter
08/02/2026 8:29 pm
TL;DR: Refresh tokens are long-lived OAuth credentials that let applications renew access without re-authentication, which means a stolen token can preserve SaaS access long after the original user has moved on, according to Obsidian Security. That makes token lifecycle governance, not just MFA and SSO, the control gap security teams need to close first.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “What Are Refresh Tokens and How to Use Them Securely”.
By the numbers:
- The tokens remained, granting access to 700+ organizations.
Key questions
Q: What breaks when an app relies on refreshable third-party tokens without lifecycle controls?
A: The main failure is that access continues to exist outside the normal review cycle, even when users disconnect, orgs change, or tokens are revoked.
Q: When does refresh token rotation reduce risk, and when is it not enough?
A: Rotation helps when you need replay detection and rapid invalidation of reused credentials.
Q: How should security teams reduce refresh token risk in SaaS environments?
A: Start with the basics that actually shrink blast radius: rotate tokens on every use, constrain sender context where possible, limit lifetimes by application sensitivity, and maintain fast revocation paths.
Practitioner guidance
- Inventory delegated refresh tokens Map every SaaS integration that stores refresh tokens, including vendor-managed connectors, automation platforms, and app-to-app OAuth grants.
- Tie token revocation to offboarding Make refresh token revocation part of employee leaver workflows, contractor exit handling, and application decommissioning.
- Set absolute token lifetimes Use short access-token lifetimes and impose a hard maximum age on refresh tokens, even where rotation is enabled.
Bottom line: Refresh tokens create a durable access layer that can survive user departure, re-authentication boundaries, and routine MFA checks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
08/10/2026 4:34 pm
Refresh token governance is the missing control layer in SaaS identity security. Organisations have spent years hardening login flows, MFA, and SSO, yet the real persistence mechanism often lives in OAuth token storage and reuse. The article shows that a token can remain valid long after the original user lifecycle has ended, which means identity governance stops too early if it ends at the account boundary. The practitioner conclusion is that token lifecycle must be treated as part of identity lifecycle, not as an app-layer afterthought.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat third-party OAuth apps as part of identity governance?
A: Yes. Third-party OAuth apps can hold valid credentials into SaaS systems, so they are effectively non-human identities with delegated access. That means ownership, approval, scope review, offboarding, and behavioural monitoring should apply to them just as they do to other privileged access paths.
👉 Read our full editorial: Refresh token governance is the missing layer in SaaS identity security