# OAuth token refresh has a race condition. Fix it with a conditional write, not a distributed lock.

DevFeed: [OAuth token refresh has a race condition. Fix it with a conditional write, not a distributed lock.](<https://devfeed.tech/articles/oauth-token-refresh-has-a-race-condition-fix-it-with-a-conditional-write-not-a-distributed-lock-16039.md>)

Original publisher: [Read original article](<https://workos.com/blog/oauth-refresh-token-race-condition>)

Author: WorkOS

Published: 2026-08-31T00:00:00Z

Content type: tutorial

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [OAuth](<https://devfeed.tech/topics/oauth.md>), [race-condition](<https://devfeed.tech/topics/race-condition.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Auth0](<https://devfeed.tech/topics/auth0.md>), [Redis](<https://devfeed.tech/topics/redis.md>)

Tags: [auth0](<https://devfeed.tech/tags/auth0.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [concurrent](<https://devfeed.tech/tags/concurrent.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [race-condition](<https://devfeed.tech/tags/race-condition.md>), [redis](<https://devfeed.tech/tags/redis.md>), [the-result](<https://devfeed.tech/tags/the-result.md>)

## AI overview

This article explains how concurrent OAuth token refreshes can cause two distinct failures: stale tokens from lost updates and user disconnection when refresh-token rotation treats concurrent reuse as replay. It recommends layered defenses, including conditional writes, and explains why a Redis lock does not address both problems.

## Source excerpt

Concurrent refreshes don't just fail. They can disconnect the user entirely. Here are four layers of defense, cheapest first, and why the Redis lock everyone reaches for isn't the one keeping you safe.