0

Can someone explain to me the purpose of the refresh token when you're using the Client Credentials grant type with OAuth2? I'm confused because you can easily generate a new access token without one, so why bother?

For example, to get an access token you typically only need:

https://oauth.example.com/token?grant_type=client_credentials&client_id=CLIENT_ID&client_secret=CLIENT_SECRET

So why would you ever use:

https://oauth.example.com/token?grant_type=refresh_token&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&refresh_token=REFRESH_TOKEN

Is a refresh token more applicable when using other grant types (eg. Resource Owner Password Credentials)?

0

I just found the answer elsewhere (credit to Florent Morselli):

Explanation

The issuance of a refresh token with the client credential grant has no benefit. That is why the RFC6749 section 4.4.3 indicates A refresh token SHOULD NOT be included. Thus its issuance is at the discretion of the authorization server.

From my point of view an authorization server should never issue a refresh token with the client credentials grant as the access token issuance process will take an additional and unnecessary step:

Issuance with the client_credentials grant type:

  • Step one: client authentication (client secret, assertion...)
  • OK access token is issued

Issuance with the refresh_token grant type:

  • Step one: client authentication (client secret, assertion...)
  • Step two: refresh token verification (expiration time, associated client...)
  • OK access token is issued

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.