---
title: "Auth0 newly issued refresh tokens get longer than the current ~45 characters: 2026-10-01 | Harbyn"
description: "Auth0 newly issued refresh tokens get longer than the current ~45 characters, announced Oct 1, 2026."
canonical: "https://harbyn.com/changes/auth0/2026-10-01-refresh-tokens-get-longer-than-45-characters"
last-updated: 2026-10-10
---

# Auth0 newly issued refresh tokens get longer than the current ~45 characters

Markdown version of <https://harbyn.com/changes/auth0/2026-10-01-refresh-tokens-get-longer-than-45-characters>.

Breaking change - Auth0. medium severity. Announced.

In the coming weeks Auth0 increases the entropy of newly issued refresh tokens, so they become longer than today's ~45 characters. Code that checks for exactly 45 characters, stores tokens in fixed-width columns such as VARCHAR(45) or CHAR(45), or caps their length with a regex breaks. Existing tokens stay valid until they expire or are revoked.

## Facts

| Fact | Value |
| --- | --- |
| Vendor | [Auth0](https://harbyn.com/vendors/auth0.md) |
| Kind | Breaking change |
| Severity | medium |
| Status | Announced |
| Announced | Oct 1, 2026 |
| Added to Harbyn | Oct 10, 2026 |
| Lead time | No dated deadline |
| Vendor page | <https://auth0.com/changelog> |
| Review | Reviewed by a person, extracted by a person |

## Find it in your code

```sh
npx harbyn scan
```

This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses Auth0, from its packages and API hosts. Nothing leaves your machine.

## Sources

Where this event comes from: the page we read, when we read it, and the hash of that snapshot.

- <https://auth0.com/changelog> (changelog, fetched 2026-10-09 13:28 UTC, sha256 `060f2dc956f4db01ad81cb799257619ff9a2f0ad235cb65b6960d348b3a22475`)

## Related changes

### More from Auth0

- [Improved Bot Detection IPv6 signal analysis](https://harbyn.com/changes/auth0/2026-10-20-improved-bot-detection-ipv6-signal-analysis.md) (Behavior change, announced Oct 20, 2026)
- [node-auth0 7.0.0, a new major version](https://harbyn.com/changes/auth0/2026-09-09-node-auth0-7-0-0.md) (Breaking change, announced Sep 9, 2026)

### Changes at other vendors

- [Amazon Selling Partner API: October listing attribute usage and enumeration value updates](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-2.md) (effective Oct 26, 2026)
- [Supabase: four CBC-mode TLS 1.2 cipher suites will be removed from project HTTP APIs](https://harbyn.com/changes/supabase/2026-10-12-an-outdated-subset-of-tls-1-2-ciphers-will-be-disabled-on-project-http-apis.md) (effective Nov 10, 2026)
- [Google Workspace APIs: OAuth clients must be marked as agentic to call Google Workspace MCP servers](https://harbyn.com/changes/google-workspace/2026-10-12-oauth-clients-must-be-marked-as-agentic-to-call-google-workspace-mcp-servers.md) (effective Nov 11, 2026)
- [Bitbucket Cloud API: Git Credential Manager upgrade required for OAuth 2.0 Git authentication](https://harbyn.com/changes/bitbucket/2026-10-13-git-credential-manager-upgrade-required-for-oauth-2-0-git-authentication.md) (effective Nov 30, 2026)

[All upcoming deadlines](https://harbyn.com/deadlines.md)