JWT refresh token sequence diagram template

Participants in this sequence diagram

• Browser app
• Resource API
• Auth server
• Token store

How to use this sequence diagram template

1. Click Open in the editor. The sequence diagram opens on a new page in FlowDiagram — nothing is uploaded and there is no sign-up.
2. Rename, add or delete shapes and drag them where you want; connectors stay attached as things move.
3. Drop in vendor logos from the library — 1,160 of them, including every AWS, Azure and Google Cloud service icon — or restyle it with the colour and theme controls.
4. Prefer text? Edit the Mermaid source below and paste it in through ☰ → Import diagram (see the Mermaid editor); it imports as an editable diagram.
5. Export to PNG, SVG or PDF, or press Ctrl+L for a link that carries the whole diagram.

Mermaid source

The whole template is the text below. Paste it into FlowDiagram, keep it in Git next to the code it describes, or hand it to an AI assistant to extend.

sequenceDiagram
  autonumber
  participant SPA as Browser app
  participant API as Resource API
  participant Auth as Auth server
  participant Store as Token store
  SPA->>API: GET /orders (Bearer access token)
  API-->>SPA: 401 token expired
  SPA->>Auth: POST /token grant_type=refresh_token
  Auth->>Store: Look up refresh token family
  Store-->>Auth: Token valid, not revoked
  alt Refresh token valid
    Auth->>Store: Rotate refresh token, revoke old one
    Auth-->>SPA: New access token + refresh token
    SPA->>API: Retry GET /orders (new access token)
    API->>API: Verify signature and expiry
    API-->>SPA: 200 orders list
  else Refresh token reused or revoked
    Auth->>Store: Revoke whole token family
    Auth-->>SPA: 400 invalid_grant
    SPA->>SPA: Clear session, redirect to login
  end
  Note over SPA,Auth: Access tokens live minutes, refresh tokens days

Related: Mermaid editor · All uml: sequence, class & state templates · All 521 templates