Configure Auth0 Access Tokens for Single Use

Administrators require a method to ensure that an access token functions only once. Restricting an access token to a single use requires configuration at the Application Programming Interface (API) layer. Administrators can configure the RFC 9068 profile for API tokens and implement a transient cache to track unique JSON Web Token IDs (jti) so the API rejects reused tokens.

• Auth0
• Access Tokens
• Application Programming Interface (API)

How does the API layer restrict access tokens to a single use?

Whether an access token functions only once depends on how the API layer controls and remembers past access tokens. The API layer must reject a token when receiving it more than once.

Configure the RFC 9068 profile to generate a unique JSON Web Token ID (jti) per token, set a short expiration time, and implement a transient cache on the API layer to track and reject reused tokens:

1. Configure the RFC 9068 as the profile for tokens of the target API to include a unique jti for each token the authorization server issues.
2. Set the expiration time to a very short duration, such as one minute.
3. Use the jti to maintain a transient memory or cache on the API layer side to track all the jti values the API receives in the last two minutes.
4. Configure the API to reject a token containing a jti that the API received in the past minute.