Refresh tokens use family-based rotation. Each refresh issues a new token in the same family and marks the old one as used. If a used token reappears, the entire family is revoked (replay attack detection).