# Prevent refresh\_token rotation **URL:** \ **Category:** Get Help\ **Tags:** awx, howto\ **Created:** [July 25, 2024, 6:06pm UTC](https://forum.ansible.com/t/prevent-refresh-token-rotation/7483 "2024-07-25T18:06:55Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![user29032902](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/user29032902/32/228_2.png) [@user29032902](https://forum.ansible.com/u/user29032902)\ **Post date:** [July 25, 2024, 6:06pm UTC](https://forum.ansible.com/t/prevent-refresh-token-rotation/7483/1 "2024-07-25T18:06:55Z")
I have a use case where I need to trigger a Job in Ansible Tower using the Tower REST API. My problem, is determining the best way to handle authentication. Under the current implementation, the `refresh_token` changes each time I use it to request a new `access_token`. This is a problem for my client application because it is stateless, and I don’t have anywhere reliable that I can _update_ the `refresh_token` with the new one returned from the Ansible Tower API. Is there a way turn off the Ansible Tower feature that generates a new `refresh_token` each time I request a new `access_token`? Ideally, I would like get a `refresh_token` from Ansible Tower that expires within 60 days of the last use. i.e. If the `refresh_token` is not used within 60 days (configurable), then the token would expire. Otherwise, it would live on. Anyone know if it’s possible to configure Ansible Tower to work this way? ---
**Author:** ![samccann](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/samccann/32/18_2.png) [@samccann](https://forum.ansible.com/u/samccann)\ **Post date:** [July 25, 2024, 6:08pm UTC](https://forum.ansible.com/t/prevent-refresh-token-rotation/7483/2 "2024-07-25T18:08:06Z")
(moved this to the [Get Help - Ansible](http://forum.ansible.com/c/help/6/none) category). ---
**Author:** ![Klaas](https://avatars.discourse-cdn.com/v4/letter/k/ecc23a/32.png) [@Klaas](https://forum.ansible.com/u/Klaas)\ **Post date:** [July 26, 2024, 7:18pm UTC](https://forum.ansible.com/t/prevent-refresh-token-rotation/7483/3 "2024-07-26T19:18:25Z")
I think you can set the expirations for those in options: ![image](https://us1.discourse-cdn.com/ansible/original/2X/6/68c1f951056b7beab00ad616612d283b8b2da191.png) [https://ansible.readthedocs.io/projects/awx/en/latest/administration/oauth2\_token\_auth.html#using-oauth-2-token-system-for-personal-access-tokens-pat](https://ansible.readthedocs.io/projects/awx/en/latest/administration/oauth2_token_auth.html#using-oauth-2-token-system-for-personal-access-tokens-pat) ---
**Author:** ![user29032902](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/user29032902/32/228_2.png) [@user29032902](https://forum.ansible.com/u/user29032902)\ **Post date:** [July 26, 2024, 8:25pm UTC](https://forum.ansible.com/t/prevent-refresh-token-rotation/7483/4 "2024-07-26T20:25:51Z")
Forgive me, but this does not appear to address my question. The `refresh_token` is still rotated each time a new `access_token` is requested. ---
**Author:** ![Klaas](https://avatars.discourse-cdn.com/v4/letter/k/ecc23a/32.png) [@Klaas](https://forum.ansible.com/u/Klaas)\ **Post date:** [July 26, 2024, 9:14pm UTC](https://forum.ansible.com/t/prevent-refresh-token-rotation/7483/5 "2024-07-26T21:14:48Z")
yes, it is, I think I am misunderstanding what you are doing, just use the access token until its end of life and don’t refresh it? the refresh token is to renew the access token if it’s expired only, right? ---
**Author:** ![user29032902](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/user29032902/32/228_2.png) [@user29032902](https://forum.ansible.com/u/user29032902)\ **Post date:** [July 29, 2024, 3:52pm UTC](https://forum.ansible.com/t/prevent-refresh-token-rotation/7483/6 "2024-07-29T15:52:54Z")
Hi Klaas, Let’s assume our Access Token Expiration was 10 minutes. After 10 minutes, we would use the `refresh_token` to request a new `access_token`. Where do I store the new `refresh_token` returned from Ansible? That’s the problem I am trying to overcome… Ideally, I would like the `refresh_token` not to change. Just be the same one, ad-infinitum, unless the `refresh_token` went 60 days with no activity. I’m asking if there is a way to disable `refresh_token` rotation. ---
**Author:** ![Klaas](https://avatars.discourse-cdn.com/v4/letter/k/ecc23a/32.png) [@Klaas](https://forum.ansible.com/u/Klaas)\ **Post date:** [July 29, 2024, 5:18pm UTC](https://forum.ansible.com/t/prevent-refresh-token-rotation/7483/7 "2024-07-29T17:18:21Z")
“Let’s assume our Access Token Expiration was 10 minutes. After 10 minutes, we would use the `refresh_token` to request a new `access_token`” yes, that is also my understanding, but not just a new access token, also a new refresh token. " Where do I store the new `refresh_token` returned from Ansible? That’s the problem I am trying to overcome…" same place you store the acess token, ideally store them together in the same object. “Ideally, I would like the `refresh_token` not to change. Just be the same one, ad-infinitum, unless the `refresh_token` went 60 days with no activity. I’m asking if there is a way to disable `refresh_token` rotation.” that does not exist as far as I know. by design the refresh token changes on usage. But what I am suggesting is you just don’t use the refresh token, store an access token with 60days, 120days, … validity and just use that one, don’t refresh it unless you want a new access token which will invalidate your old one. If you want a new access token without invalidating your old one you need to create a new token - not use the refresh\_token.