Refresh Tokens and Expiry
Rotate access tokens without re-login.
Refresh Tokens and Expiry is a free Flask Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Flask Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Tokens Expire
A stolen token is dangerous only while it works. Giving every access token a short expiry shrinks that window of risk. ⏳
The exp Claim
Expiry lives in the token's exp claim, a timestamp. Once the clock passes it, the token is rejected no matter what.
Set the Lifetime
Control how long access tokens last with JWT_ACCESS_TOKEN_EXPIRES. A short span like 15 minutes is a sensible default.
from datetime import timedelta
app.config["JWT_ACCESS_TOKEN_EXPIRES"] = timedelta(minutes=15)The Re-Login Problem
Short expiry is safe but annoying if users must type their password every 15 minutes. The refresh token solves exactly this.
Two Tokens, Two Jobs
A short access token calls your API; a long-lived refresh token does nothing but request fresh access tokens.
Issue Both at Login
At login, mint an access token and a refresh token together, then return both to the client.
from flask_jwt_extended import create_refresh_token
rt = create_refresh_token(identity=user.id)A Refresh Endpoint
Add a /refresh route guarded by jwt_required(refresh=True) so only a valid refresh token can reach it.
@app.post("/refresh")
@jwt_required(refresh=True)
def refresh():
...Hand Back a New Access Token
Inside /refresh, read the identity and mint a brand-new access token. The user keeps going without retyping a password. 🔄
new = create_access_token(identity=get_jwt_identity())
return {"access_token": new}Refresh Tokens Live Longer
Set JWT_REFRESH_TOKEN_EXPIRES to days or weeks. It is exposed less often, so a longer life is an acceptable trade.
app.config["JWT_REFRESH_TOKEN_EXPIRES"] = timedelta(days=30)Store the Refresh Token Safely
Because it is powerful, keep the refresh token in secure storage, never in plain JavaScript-readable space, and send it only to /refresh.
Revoking Tokens
To truly log someone out, add a blocklist of token ids the server refuses. This is the one bit of state stateless auth sometimes needs.
Quick Check
Recall the job each token type does.
Recap
Keep access tokens short and pair them with a long-lived refresh token that buys new ones at /refresh. Add a blocklist to revoke. ✅
Frequently asked questions
Is the “Refresh Tokens and Expiry” lesson free?
Yes — the full text of “Refresh Tokens and Expiry” is free to read here on the web, and the Flask Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Flask Academy course, upgrade to CoddyKit PRO.
What will I learn in “Refresh Tokens and Expiry”?
Rotate access tokens without re-login. You practise Flask Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Flask Academy?
No prior experience is required. Flask Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Refresh Tokens and Expiry” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Flask Academy lesson?
Yes. Every Flask Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Sessions vs Stateless Tokens
- Issue Access Tokens on Login
- Protect Endpoints with jwt_required
- Refresh Tokens and Expiry