Is `auth_time` in refresh token metadata reliable for MFA + PASSWORD flows?

[FASupportBot]

When querying the refresh token endpoint GET /api/jwt/refresh?userId={userId}, some refresh tokens include a data sub-object under metaData containing fields like auth_time and authentication_type.

This metadata appears to be present for the following authentication types:

• PASSWORD
• PASSWORDLESS
• SAMLv2IdpInitiated
• SAMLv2

However, when users authenticate using MFA + PASSWORD, the data sub-object is missing from the refresh token metadata.

Is this data object (specifically auth_time and authentication_type) something that can be reliably used across all authentication flows in current and future versions of FusionAuth? Or is its presence inconsistent and not intended as a stable API feature?

[FASupportBot]

The data sub-object containing auth_time and authentication_type in refresh token metadata is not currently a documented or officially supported feature in FusionAuth. Its presence is inconsistent across authentication flows, as you've observed — it appears for some authentication types but not others (notably absent for MFA + PASSWORD flows).

According to the official documentation, the only documented fields within refresh token metaData are:

• metaData.device — An object containing device information (name, type, description, lastAccessedAddress, lastAccessedInstant)
• metaData.scopes — An array of OAuth scopes associated with the token
• metaData.resources — An array of resource URIs per RFC 8707 (available since v1.67.0)

The data sub-object with auth_time and authentication_type that you're observing is not part of the documented API contract. Because this is undocumented behavior, you should not rely on it in production code, as it may change or be removed in future versions without notice.

Important Distinction: auth_time on JWTs vs Refresh Tokens

Note that auth_time is a standard and documented claim on access tokens and ID tokens (the JWTs themselves), where it represents the time of initial authentication. However, it is not a documented field on the refresh token record itself when queried via the retrieval API.

Related Documentation

• Retrieve Refresh Tokens API — Official API documentation including the complete response body structure for refresh tokens
• Access Token and ID Token Claims — Where auth_time is officially documented as a JWT claim
• Multi-Factor Authentication (MFA) — Guide to implementing MFA in FusionAuth
• JWT Refresh API — How to use refresh tokens to obtain new access tokens