Hacker News Reader

> invalidating refresh keys after single use

That's called refresh token rotation and is a valid security practice.

Not sure why Google doesnt do this but Atlassian does.

Google OAuth2 refresh tokens are definitely singe use.

Atleast not documented here https://developers.google.com/identity/protocols/oauth2#5.-r.... They have a limit on the number of tokens but not on number of uses per token.