Contents
Are refresh tokens required?
So why does a web application need a refresh token? The main reason to use refresh tokens in web applications is to reduce the lifetime of an access token. When a web application obtains an access token with a lifetime of five to 10 minutes, that token will likely expire while the user is using the application.
What is a refresh token for?
A Refresh token is a string that represents an authorization that was granted to a client to use a particular set of web services on behalf of a user to access data for a particular institution. Refresh Tokens are issued to the client by OCLC’s Authorization Server upon request of an Access Token.
How are refresh tokens used in the authorization server?
Unlike Access Tokens, Refresh Tokens are only used with the Authorization Server and are never sent to a web service. Our Explicit Authorization flow allows clients to request a Refresh Token when a request for an Access Token is made.
What happens when you exchange an access token?
The response will be a new access token, and optionally a new refresh token, just like you received when exchanging the authorization code for an access token. If you do not get back a new refresh token, then it means your existing refresh token will continue to work when the new access token expires.
When do refresh tokens leave the backend?
For example, on web applications, refresh tokens should only leave the backend when being sent to the authorization server, and the backend should be secure. The client secret should be protected in a similar fashion.
What are the parameters for an access token request?
The request needs to include the following parameters: The request must also be signed using an HMAC Signature generated using the client’s WSKey and secret. If the request for an Access Token is successful, then the Authorization Server will return a JSON response that contains the Access Token information.