What is refresh token rotation, and what attack does it defend against?

Every time a refresh token is used, the server issues a brand-new refresh token and invalidates the old one. If a stolen refresh token is ever replayed by an attacker after the legitimate user already rotated it, the old token is rejected — and detecting that reuse is itself a signal the token was compromised, letting you revoke the whole token family immediately.