Given a valid access token alone (you don't know username+password), should you be able to get a refresh token?


The idea of refresh Tokens is you use them only once - to get a new refresh token and a new Auth token. This way the token to go on was never used before and can only be used once.


The Authorization Server serves them as a response to the authorization grant, if requested by type. This step can be skipped and you can directly request Auth Tokens. But Auth Tokens are not supposed to be exchanged for other grants.

  • thank you for your reply. I've read that already and was unclear about my question. In your opinion, the only way to obtain a refresh token after authentication is by via refresh-token (send a refresh-token, get another refresh-token AND a auth token)? – Leonardo Mar 18 at 13:21
  • according to OAuth protocol yes - if somebody implements other methods, you never know. – eckes Mar 18 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.