Refresh token security review cost: $2,400, own it

Refresh token security review cost is $2,400 once for one app whose login can mint a new access token from a longer-lived refresh token. $1,200 starts the work. The report is due 48 hours after that refresh call works on a test user. You own the PDF. There is no subscription.

Short answer: Refresh token security review cost is $2,400 once, with $1,200 to start, for one app that trades a refresh token for a new access token. I check whether that refresh token rotates, how long an unused one still works, and what the new access token is allowed to do. The report lands 48 hours after access works. You own it. An OAuth callback review and a multi-week accredited pentest are different purchases. The offer is the web application security review.

What does a refresh token security review cost?#

$2,400 once for one app, $1,200 to start, the rest when the PDF lands. You own that file. You are not buying an Auth0 seat, a scanner subscription, or a certificate I do not hold.

The table uses published lifetimes, not guesses. Auth0’s access-token lifetime defaults to 86,400 seconds (24 hours), with a ceiling of 30 days. Auth0’s refresh expiration defaults the idle lifetime to 2,592,000 seconds (30 days). Turn the maximum lifetime off and Auth0 says the absolute lifetime is indefinite. That is their product, not your token endpoint.

What you are buying	2026 price	What you actually get
Auth0 access token	24 hours default	Their API setting. Not a test of your refresh call
Auth0 idle refresh lifetime	30 days default; absolute can be indefinite	Their product. A leaked refresh token still mints access until it dies
Mostly automated scan	$100–$3,000	Tool output. Thin judgment on reuse
This review	$2,400 once, $1,200 to start	One app, the refresh call and the access token it mints, report in 48 hours, one retest
Manual web app or API test	$2,500–$5,500	Longer calendar, wider app, exploitation evidence in the report

WardenBit’s 2026 guide puts $100–$3,000 on mostly automated scanning. Pentestica’s price guide, updated 2 October 2026, lists a manual web application or API test at $2,500–$5,500, with exploitation evidence in the report. Mine does not. Two passes, a year apart, are $4,800 over 24 months. Three are $7,200 over 36 months.

The same $2,400 is on pricing. If the product is a SaaS app with customer accounts, the industry page is website security review for SaaS. A callback-URI pass is a different writeup: OAuth redirect security review cost.

What does the $2,400 check when a refresh token mints access?#

I refresh once on the test user you send and record whether the old refresh token still returns another access token. The pass covers that call, the new access token, and whether logout or a password change stops the family. I do not ship a recipe for stealing one.

RFC 9700 says a public client’s refresh token must be sender-constrained or rotated: a new refresh token on every access-token refresh, and the previous one invalidated. Reuse revokes the active refresh token. The server cannot tell which party presented the bad one. Refresh tokens should expire after inactivity. Auth0’s rotation guide revokes the family on reuse. A homegrown endpoint often keeps the same refresh token and still calls the access token short-lived.

I record, in plain findings:

• Whether a second use of the same refresh token still returns an access token after one successful refresh.
• Whether the new access token is narrower than the consented scope, and which API it names.
• How long an unused refresh token still works, against the idle lifetime you think you set.
• Whether logout or a password change stops the next refresh.
• Whether the refresh token stays on the token endpoint you named, not in a place you told me was public.

The document shape is the sample pentest report. No client names. No exploit steps. No token values.

What is not included for $2,400?#

You get severity, the refresh path, the role, and a fix an engineer can ticket, for one authorized app. I do not ship exploit steps, an Auth0 tenant audit, a second app, or a certificate I do not hold. The PDF is yours. There is no monthly fee.

I do not need tenant admin. If the refresh token is in a browser bundle, I name the path and I do not print the token. An email link is a different writeup: magic link security review cost. A session cookie that never hits a refresh call is a different pass. A second app is a second quote.

This is not AI Front Door, where a customer books or pays from ChatGPT, Claude, Grok, or another AI app that supports MCP connectors. MCP is the open standard those apps use to connect to a business’s tools. It is not Workflow Automation either. That offer is $3,500 once for one repeating ops job, such as an invoice chase, and it does not test a token endpoint.

How does the review run from the refresh call to the PDF?#

You authorize one app, I refresh with the test user you send, and the clock starts when that call works. The PDF is what you keep. I do not rotate production tokens for you.

Step	What happens
Trigger	A buyer asked whether a stolen refresh token keeps minting access, or you just shipped rotation
Action	I refresh once and record what the next call still accepts
System of record	The running token endpoint, plus the written findings: severity, path, role, fix
Human escalation	You ticket the change. I do not edit production inside this price

Send written authorization, one test user that can obtain a refresh token, and the lifetimes you believe are set. Say whether logout or a password change must kill the family. One free retest of that same app is included within 14 days.

When this isn’t the right move yet#

Do not pay the $1,200 if the app does not issue a refresh token yet, or if I cannot legally call the token endpoint. A pass with no refresh is a normal login skim. Ship the refresh call, then book the review.

Wait if the lifetime is still a ticket and there is nothing live to call. Hire the firm that holds CREST if the questionnaire requires that name. If the only question is where the browser returns after login, read the redirect post instead of buying this one twice. A missed phone is the receptionist, $8,000 once, not this review.

What should be true before I start?#

Bring one token endpoint, one test user, and the idle and absolute lifetimes you think you set. I start when that refresh call behaves like production, not when the vendor dashboard looks finished.

Before you pay, write the list:

• The idle lifetime and the absolute lifetime you intend, in days.
• Whether a used refresh token must fail on the next call.
• The audience and scopes a fresh access token may carry.
• Whether logout or a password change must stop the family.

If you want the layout before credentials, ask for the sample from the contact form.

$1,200 reserves the work on the review page. I confirm scope in writing before I start. The form is short. I reply with the replacement map within 24 hours. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.