Spring Security keeps a refresh token internally, and only requests a new access token when the "current" access token is expired.

However, how to explicitly request/force Spring Security to request a new access token from the Authorization Server, even though the current access token is not expired yet?

I'm in a use case where my API server invalidates the access token sent by my client on every request, to every request to the API needs a new access token generated by my client.

Comment From: godfriedmeesters

So the question is, can Spring Security on the client side create "one-time" access tokens instead of waiting for (opaque) access tokens to be expired? If I send the same access token to the API, the API will complain that I cannot use the same access token twice.

Comment From: godfriedmeesters

Can be closed, as a hack I cache the result of the token introspection so that no invalid token exception is thrown anymore.

 @Cacheable("introspectionCache")
 public OAuth2AuthenticatedPrincipal introspect(String token) {   ...