Under the covers, how are RefreshTokens kept track of? (ASP.NET Owin/OAuth2)

Question

Even if we stop the API, or shut down the whole machine, resuming it still keeps track of the refresh tokens that have been issued to the clients. How is this achieved?

Answer 1

A refresh token is typically stored in a database by the authorization server.

It is also common for mobile UI clients to store them in OS secure storage.

It is also common for server side web apps to include the refresh token in an auth cookie so that it remains available across requests.

Your API should only ever receive access tokens - and should not know anything about refresh tokens.

I'd need to know more about your specific scenario to be able to advise further.