I've been reading Google's oauth2 documentation for Client-side applications. I was surprised that nowhere does it mention refresh tokens. Also, their examples hint that the access_token has a default TTL of 3600 seconds. Clearly, I do not want my active users needing to relogin once every hour.

Question: Is there a reason why the Client-side oauth2 implementation doesn't support refresh tokens? Or, is this supported by Google but simply not documented?


The OAuth 2.0 specification prohibits the issuing of a refresh token to non-confidential clients. A client-side application is not considered a confidential client.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.