docs: add note about refresh token invalidation
@@ -72,6 +72,16 @@ have multiple reasons:
The most likely cause is misconfiguration, summarized in the next sections.
+## Refresh Token Flow fails
+
+Refresh tokens can become invalid if abuse is detected, but coding issues may also trigger
+this scenario, for example if a client makes multiple requests.
+
+Some common examples:
+
+1. Replay of authorization code grant.
+2. Replay of refresh token grant.
+
### Wrong or misconfigured OAuth 2.0 Client
You are using the wrong OAuth 2.0 Client or the OAuth 2.0 Client has a broken
