...
The refresh token grant can be used when the current access token is expired or when a new access token is needed. With this grant type, the refresh token acts as a credential and is issued to the client by the authorization server. Issuing a refresh token is optional and if the authorization server issues a refresh token, it is included when issuing an access token. WSO2 Identity Server issues refresh tokens for all other grant types other than the implicit and client credentials grant types, as recommended by the OAuth 2.0 specification.
| Note |
|---|
This refresh token needs to be kept private, similar to the access token. When using this token, keep in mind that it issues the access token without a user interaction. |
The flow
In order to use this grant type, a A refresh token needs has to be already received when using obtained before using it with a grant type like such as the authorization code , password or client credentials. Then using this received or password grant type. Using the obtained refresh token, you can obtain a new access token can be received along with a new renewed refresh token without going having to go through any other additional steps.
Configurations
This can configurations are done in the <IS_HOME>/repository/conf/identity/identity.xml file.
- The
<RefreshTokenValidityPeriod>The<RefreshTokenValidityPeriod>element is in seconds. By default, it is valid for one day. You can configure this Configure it accordingly. The
<RenewRefreshTokenForRefreshGrant>element is by default set to totrueby default.Info The refresh token is renewed when the refresh grant is used to get an access token. A new refresh token is issued with a new expiry time and the previous refresh token is then made inactive and can no longer be used. If this element is set to false, unless the refresh token has expired, the same refresh token is returned.
Code Block language xml theme Eclipse <!-- Validity period for refresh token --> <RefreshTokenValidityPeriod>84600</RefreshTokenValidityPeriod> ... <!-- Enable renewal of refresh token for refresh_token grant --> <RenewRefreshTokenForRefreshGrant>true</RenewRefreshTokenForRefreshGrant>
Try it out
...
Run the following cURL command to try out the refresh token grant.
...