Werk #22274: OAuth clients can renew sessions with refresh tokens
| Component | Setup | ||||
| Title | OAuth clients can renew sessions with refresh tokens | ||||
| Date | Nov 3, 2026 | ||||
| Level | Trivial Change | ||||
| Class | New Feature | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
OAuth clients, such as MCP clients, used to receive only an access token. When it expired after 48 hours, you had to authorize the client in the browser again. Checkmk now also issues a refresh token, so clients renew their sessions themselves and you no longer have to approve them every two days.
Session lifetimes
Three settings limit how long an OAuth session lasts. You find them under Setup > Global settings > User management > OAuth sessions. They apply to every OAuth client, not only to MCP clients:
- Session lifetime (default: one year): After this time you have to log in and approve the client again, however actively the client uses the session.
- Refresh token lifetime (default: 30 days): A session ends if the client does not refresh it within this time.
- Access token lifetime (default: 48 hours): A client can call the API with one access token for this long before it has to refresh.
Changes to the session lifetime apply only to new sessions. Changes to the token lifetimes apply to every token issued afterwards, including tokens of existing sessions.
Leaked refresh tokens
Every refresh replaces the refresh token with a new one. If a client presents a refresh token that has already been used, Checkmk assumes that someone copied it. Checkmk then ends the session and writes the event "oauth refresh token reused, grant revoked" to the security log, together with the user, the client ID and the requesting IP address. If you see this event, find out where the token leaked.
Consequently, a client must refresh from a single place and always keep the newest refresh token. A client that refreshes concurrently, or retries with an old token after a lost response, ends its own session. The user then has to authorize it in the browser again.