Does refreshing a token causes the old token to be revoked

[Roi Kramer]

I was wondering, when I refresh a token, does it causes the old token to be revoked even if it was not yet expired?

[Daniil Penkin · Accepted solution]

Hello @Roi Kramer,

I assume you're asking about validity of access tokens (you use refresh token to get an access token). The answer is no: the access token that hasn't expired yet will not be revoked if you request a new access token.

Simply speaking, expiry time and other parameters are encoded in the access token itself and entire token is encrypted with refresh token. When you use your access token to authenticate a request, Bitbucket decrypts the token using refresh token and reads its metadata. So any access token which Bitbucket still has matching refresh token for will work.

If you revoke the refresh token though (remove OAuth consumer or revoke your consent in your account settings), all access tokens will stop working, even those that haven't expired yet.

Let me know if you have any questions.

Cheers,
Daniil