AWS Cognito+Dart场景下，Refresh Token能否提前刷新及自身可刷新？

Let’s break down your two questions clearly, since you’re working with manual AWS Cognito API calls in Dart:

1. Can a Refresh Token itself be refreshed? #

Absolutely—this is the default behavior in AWS Cognito. When you use a valid refresh token to request new ID and access tokens (via the refreshToken auth flow), Cognito will automatically return a new refresh token alongside the updated ID/access tokens.

The only exception is if you’ve explicitly disabled refresh token rotation in your user pool’s app client settings. If you turn off the "Rotate Refresh Tokens" option, Cognito will reuse the same refresh token for subsequent requests until it expires. For security best practices though, keeping rotation enabled is recommended—it limits the window of risk if a token is compromised.

2. Can I refresh a Refresh Token before it expires? #

Yes, absolutely—and this is a recommended practice! You don’t have to wait for the refresh token to expire to use it. As long as the refresh token is still valid (hasn’t expired, hasn’t been revoked, and the user’s account is active), you can call the Cognito API at any time to get a fresh set of tokens.

This proactive approach helps maintain seamless user sessions: you can refresh tokens before the access token expires, or on app launch, instead of waiting for an expiration error that might disrupt the user experience.

Quick Dart API Tip #

When making manual calls in Dart, send a POST request to your Cognito IDP endpoint (https://cognito-idp.<your-region>.amazonaws.com/) with these key parameters:

• AuthFlow: REFRESH_TOKEN_AUTH or REFRESH_TOKEN
• ClientId: Your app client ID
• AuthParameters: A map containing REFRESH_TOKEN with your existing valid refresh token

Cognito will respond with new ID, access, and (if rotation is enabled) refresh tokens you can store for future use.

内容的提问来源于stack exchange，提问作者Mauricio De armas