Refresh token rotation
Issuing a new refresh token on every use and invalidating the old one, so reuse of a stolen token is detected.
With refresh token rotation each refresh returns a new refresh token and the previous one is marked used. If a used token is presented again, either the client or an attacker has a copy, so the authorisation server revokes the whole token family and forces re-authentication.
RFC 9700 requires public clients (SPAs, mobile apps) to use either rotation or sender-constrained refresh tokens (DPoP or mTLS), because a refresh token in a browser or on a device is otherwise a long-lived bearer credential.
Edge cases cause most bugs: two browser tabs refreshing at once trip reuse detection and log the user out, so servers allow a short grace period; network failures after the server rotated but before the client stored the new token look identical to theft. Token families must be stored and revocable server side.