I was reading the OAuth protocol docs https://datatracker.ietf.org/doc/html/rfc6749#section-6 where it implies that you don't need a client_id and client_secret to refresh an access token, just a grant_type and the refresh token.

I was of the believe that in a situation where your refresh token is compromised, an attacker may not have your client id and secret therefore won't be able to get new access token even if they send a request to your server for one.

What am I missing here? Isn't the risk greater when you don't need extra layer of security checks to get new access tokens?

For context: This is for a Django application that uses Django rest framework for API support and simplejwt for API protection. Authentication is handled using CAS.

  • The authorization server has to validate/authenticate the user when refreshing a token. That's done outside of any claim in a token. The refresh token may also be set to one-time use. Only the content/resource server trusts claims held in a token. Jul 11, 2022 at 20:18

1 Answer 1


The section that you quoted contains the following statement

If the client type is confidential or the client was issued client credentials (or assigned other authentication requirements), the client MUST authenticate with the authorization server as described in Section 3.2.1.

and also gives an example with an Authorization: Basic header. To me this implies that the client does need client_id and client_secret to refresh the token (in the form of the basic authentication).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .