1

Can someone explain to me the purpose of the refresh token when you're using the Client Credentials grant type with OAuth2? I'm confused because you can easily generate a new access token without one, so why bother?

For example, to get an access token you typically only need:

https://oauth.example.com/token?grant_type=client_credentials&client_id=CLIENT_ID&client_secret=CLIENT_SECRET

So why would you ever use:

https://oauth.example.com/token?grant_type=refresh_token&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&refresh_token=REFRESH_TOKEN

Is a refresh token more applicable when using other grant types (eg. Resource Owner Password Credentials)?

1 Answer 1

1

I just found the answer elsewhere (credit to Florent Morselli):

Explanation

The issuance of a refresh token with the client credential grant has no benefit. That is why the RFC6749 section 4.4.3 indicates A refresh token SHOULD NOT be included. Thus its issuance is at the discretion of the authorization server.

From my point of view an authorization server should never issue a refresh token with the client credentials grant as the access token issuance process will take an additional and unnecessary step:

Issuance with the client_credentials grant type:

  • Step one: client authentication (client secret, assertion...)
  • OK access token is issued

Issuance with the refresh_token grant type:

  • Step one: client authentication (client secret, assertion...)
  • Step two: refresh token verification (expiration time, associated client...)
  • OK access token is issued

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .