docs: add note about refresh token invalidation
See
@@ -72,6 +72,16 @@ have multiple reasons:
The most likely cause is misconfiguration, summarized in the next sections.
+## Refresh Token Flow fails
+
+ Refresh tokens can become invalid if abuse is detected, but coding issues may also trigger
+ this scenario, for example if a client makes multiple requests.
+
+ Some common examples:
+
+ 1. Replay of authorization code grant.
+ 2. Replay of refresh token grant.
+
### Wrong or misconfigured OAuth 2.0 Client
You are using the wrong OAuth 2.0 Client or the OAuth 2.0 Client has a broken
