Security API trainer

Token Refresh API Practice

Practice testing access token expiry, refresh token rotation, revoked sessions, token reuse, and secure auth error handling.

Start writing test ideas Try API sandbox

How to use this trainer

Choose, send, inspect, write, improve

Safe client-side simulator. No real backend is called and no real data is sent.

1Choose a preset case
2Send a simulated request
3Read the response and QA note
4Write what you would test
5Check your coverage

Interactive sandbox

Try the API request

Edit the request body, send a simulated POST /api/auth/refresh request, and inspect rotation, revocation, and auth error behavior. No real token is sent.

Request

Build the refresh request

POST/api/auth/refresh

Request JSONapplication/json

Content-Type

Test case presets

Choose a case, inspect the fake response, then write what you would test.

Happy path

Validation / contract

Expiry / revocation

Rotation / abuse

Response

Fake API result

Send a simulated request to see the HTTP status, JSON response, QA note, and the token/security risks this case should make you mention in your answer.

What would you test?

List valid refresh, token expiry, rotation, reuse detection, revocation/logout, authorization claims, safe errors, rate limiting, logs, outages, concurrency, and performance.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance

API ReferenceEndpoint, request fields, responses, and business rulesExpand

API reference

Token Refresh endpoint

Exchange a valid refresh token for a new access token and, if rotation is enabled, a new refresh token.

Endpoint

POST/api/auth/refresh

Purpose

Exchange a valid refresh token for a new token pair.

Request fields

refreshToken: string, required

Success response

200 OK

Request body

{
  "refreshToken": "valid-refresh-token"
}

Success response body

{
  "accessToken": "new-access-token",
  "refreshToken": "new-refresh-token",
  "expiresIn": 900,
  "tokenType": "Bearer"
}

Errors

400 validation error
401 invalid, expired, revoked, reused, or wrong token type
429 rate limited
503 auth service unavailable

Security notes

Refresh token should not be logged
Access token and refresh token should not appear in analytics
Reuse detection should revoke the token family if required
Logout should invalidate refresh token
Rotation should make old refresh token unusable

Business rules

refreshToken is required
valid refresh token returns a new access token
rotation can return a new refresh token
old refresh token becomes unusable after rotation
expired, revoked, and reused refresh tokens return 401
logout invalidates the refresh token
access tokens cannot be used as refresh tokens
rate limiting protects repeated refresh attempts
token values are never logged or sent to analytics
auth provider and session-store outages fail safely

API interview guide

What this Token Refresh API practice covers

This scenario trains session continuity testing for access-token expiry, refresh-token rotation, revocation, reuse detection, and auth service failures.

Key risks covered

- Valid refresh returns a new access token and correct expiry metadata.
- Expired, revoked, reused, malformed, missing, and wrong-token-type requests.
- Refresh token rotation invalidates old refresh tokens according to requirements.
- Logout, revoked sessions, and token-family behavior are enforced.
- Rate limiting, no token logging, auth-provider outage, and safe 401/429/503 responses.

Example interview prompt

How would you test a token refresh API that rotates refresh tokens and rejects reused or revoked sessions?

Common mistakes

- Treating refresh as a simple happy-path token exchange.
- Missing reuse detection, logout invalidation, and wrong token type.
- Not checking logs, analytics, rate limiting, or auth provider outages.