Supabase
Security & compliance
Refresh-token reuse interval over 30 seconds
Part of the Auth hardening & exposure config check · fix arrives as a guide
What it is
The refresh-token reuse interval is configured above 30 seconds.
Why it matters
That interval is the window in which a rotated refresh token still works. Widening it weakens the reuse detection that catches a stolen token being replayed, because the theft looks like a normal retry.
How to fix it
Set the reuse interval to 10 seconds or less — enough to tolerate a client retrying a failed refresh, short enough that replay is detected and the session revoked.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.