The developer-app OAuth flow rotates refresh tokens. The app must use the latest refresh token and store the replacement tokens together when a refresh succeeds.
Serialize refreshes for each connection so two server workers do not reuse the same old token at the same time. The documented behavior is that refresh-token reuse revokes the grant.
If the grant has been revoked, return the customer through a new authorization flow rather than repeatedly retrying the old token. Confirm the company and scopes again when the customer reconnects.
Refresh also cannot expand the original scope. A new permission needs new consent, and changed company access or a suspended app can stop an otherwise valid token. In diagnostics, log safe connection identifiers and error codes, not token values. Distinguish this developer-app OAuth token lifecycle from the separate MCP connection portal, whose grant durations and session-renewal behavior follow its own consent flow.
Was this article helpful?
Tell us whether this answered the question you came with.