Add Refresh Tokens to Your Hono OIDC Server (with Token Rotation)

The previous articles in this series built a working OIDC Authorization Code Flow server , fixed the hardcoded issuer , discussed persistent signing keys , and added a consent screen . Now it's time to tackle the refresh token grant. Access tokens are short-lived by design (~30 minutes - 90 minutes). Once they expire, the client needs a new one. Without refresh tokens, that means sending the user back through the login and consent flow every hour. That makes a TERRIBLE experience for long-lived