In OAuth 2.0, I'm confused about hwy we need a refresh token flow. Per my understanding, when you submit a "refresh_token" grant type, you receive an access token, its expiration, and a refresh token. Then, if the access token has expired, you can submit a new request for an access token using the refresh token and the client credentials. How's this different than just getting an access token using the client_credentials flow? There, you are also required to submit your credentials for exchange of an access token, so I'm not clear on why you would need the refresh token flow at all.
1 Answer
Because you are not supposed to know the the credentials! If you allow users of your app to use their CloudDrive with your app, they login to CloudDrive using credentials. You never get the credentials! When a access token is only valid e.g. 15 minutes, your users would need to enter their credentials every 15min. Users don't like this!
If you wonder why there are different access and refresh tokens and not only one token with long validity, check this answer!
-
The refresh token flow requires the client key and secret to be submitted, so if you are getting a refresh token every 15 minutes, I don't see how that is different than asking for an access token every 15 minutes using "client_credentials" grant type. In both cases you are submitting your client key and secret every 15 minutes.– DaveCommented Jul 9, 2019 at 16:38
-
@Dave refresh tokens usually don't expire after 15min. Also, you get a access token using only the refresh token and don't need the credentials! Do you have a specific service in mind where this is the case?– JosefCommented Jul 9, 2019 at 20:05