There is no "one-time" over the network. Invalidating the refresh token immediately when the server recieves it is asking for trouble.