Long-lasting refresh tokens in self-contained format

A non-transitory, computer-readable medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations, the operations comprising:

• regenerating and storing, by a client application, a new protected version of a refresh token based on a new version of a client key, wherein the new protected version of the refresh token is an encrypted version of the refresh token based on the new version of the client key, wherein the new version of the client key replaces a previous version of the client key persisted at a key store for the client application, wherein a single version of the client key is maintained at any point in time at the key store;
• sending, by the client application and to an authorization server, a request to generate a new access token for authorization of the client application with an application server, wherein the request includes the new protected version of the refresh token to authenticate with the authorization server for generating the new access token for authorization of accessing resources at the application server;
• and
• receiving, by the client application and from the authorization server, the new access token, wherein the new access token is successfully validated at the authorization server based on decrypting the new access token using the new version of the client key.

A system comprising

• a computing device;
• and
• a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations, the operations comprising:
• regenerating and storing, by a client application, a new protected version of a refresh token based on a new version of a client key, wherein the new protected version of the refresh token is an encrypted version of the refresh token based on the new version of the client key, wherein the new version of the client key replaces a previous version of the client key persisted at a key store for the client application, wherein a single version of the client key is maintained at any point in time at the key store;
• sending, by the client application and to an authorization server, a request to generate a new access token for authorization of the client application with an application server, wherein the request includes the new protected version of the refresh token to authenticate with the authorization server for generating the new access token for authorization of accessing resources at the application server;
• and
• receiving, by the client application and from the authorization server, the new access token, wherein the new access token is successfully validated at the authorization server based on decrypting the new access token using the new version of the client key.