Token Rotation

Expanded Definition

Token rotation is a session hardening pattern for NHIs and OAuth-style workloads: every time a refresh token is used, the old token is invalidated and replaced with a new one. That reduces replay windows and makes reuse easier to detect, but it is not a complete compromise control. In practice, rotation only becomes meaningful when paired with atomic invalidation, family tracking, telemetry, and immediate revocation of related grants.

Definitions vary across vendors on whether rotation applies only to refresh tokens, also to access tokens, or to broader secret families used by agents and service accounts. In NHI operations, the term usually sits alongside dynamic secrets, lifecycle enforcement, and zero standing privilege. NHI Management Group treats token rotation as a response mechanism, not a substitute for proper identity issuance, vault hygiene, or scope limitation. The OWASP Non-Human Identity Top 10 frames this as a governance issue because a rotated token that still maps to excessive privilege remains exploitable.

The most common misapplication is calling a token "rotated" when the old credential remains valid in another store, which occurs when revocation is asynchronous or downstream caches are not cleared.

Examples and Use Cases

Implementing token rotation rigorously often introduces state-management overhead, requiring organisations to balance replay resistance against compatibility with legacy applications and distributed caches. It also forces security teams to decide how much session continuity they can tolerate when one token in a family is suspected of misuse.

• An API gateway issues a new refresh token on every successful exchange and invalidates the previous one immediately, so a captured token cannot be reused after the next legitimate login.
• A workload agent storing credentials in a secrets manager rotates its access path after each deployment, following the same lifecycle thinking described in the NHI Lifecycle Management Guide.
• A security team investigates abnormal reuse by comparing token lineage and source IPs, then correlates findings with patterns highlighted in the Guide to NHI Rotation Challenges.
• OAuth clients in a production SaaS integration rotate refresh tokens after each redemption, limiting the blast radius if a token is exposed in logs, chat, or a ticketing system.
• Detection pipelines pair rotation with policy checks from the OWASP Non-Human Identity Top 10 so token reuse becomes an alert rather than a silent failure.
• Lessons from the Salesloft OAuth token breach show why rotation must be coupled with revocation and scope reduction, not only scheduled renewal.

Why It Matters in NHI Security

Token rotation matters because exposed NHI credentials are rarely harmless. In The State of Secrets Sprawl 2026, GitGuardian reported that 64% of valid secrets leaked in 2022 are still valid and exploitable today, which is a direct warning that detection without invalidation leaves real exposure in place. In the NHI domain, that means a rotated token that is not fully revoked still behaves like a live key if an attacker already copied it.

This is especially important for agents, CI/CD systems, and service accounts because token compromise often happens outside the primary application boundary, in logs, collaboration tools, build runners, or configuration files. NHI teams also need to align rotation with the broader lifecycle controls described in the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs and the secret handling guidance in the Guide to the Secret Sprawl Challenge. For governance teams, the relevant question is not whether tokens change, but whether compromised privilege is actually removed.

Organisations typically encounter the operational need for token rotation only after a replay event, at which point revocation, lineage tracing, and blast-radius containment become unavoidable to address.

Related resources from NHI Mgmt Group

• Should organisations prioritise runtime attestation over faster token rotation?
• When does refresh token rotation become a priority control?
• What is the difference between token rotation and token detection?
• Should organisations prioritise token rotation or app inventory first?