Contents
How do I get access and refresh token?
Request an access token by redeeming the code returned after the user granted consent. Get the access_token, refresh_token, and expires_in values from the JSON response stream. When you received an access token, the value of expires_in represents the maximum time in seconds, until the access token will expire.
How do I refresh user token?
To use the refresh token, make a POST request to the service’s token endpoint with grant_type=refresh_token , and include the refresh token as well as the client credentials.
What is refresh token?
A Refresh token is a string that represents an authorization that was granted to a client to use a particular set of web services on behalf of a user to access data for a particular institution. Refresh Tokens are issued to the client by OCLC’s Authorization Server upon request of an Access Token.
When should I use offline token?
The offline token is valid even after a user logout or server restart. However by default you do need to use the offline token for a refresh token action at least once per 30 days (this value, Offline Session Idle timeout , can be changed in the administration console in the Tokens tab under Realm Settings ).
What is the expiration time for refresh token?
The access token is set with a reasonably lower expiration time of 30 mins.
How long does a refresh token live?
Refresh tokens are valid for 90 days, and with continuous use, they can be valid until revoked. User’s password has changed since the refresh token was issued. An administrator can apply conditional access policies that restrict access to the resource the user is trying to access. The default lifetime for the access token is 1 hour.
What is a primary refresh token?
A Primary Refresh Token (PRT) is a key artifact of Azure AD authentication on Windows 10, iOS, and Android devices. It is a JSON Web Token (JWT) specially issued to Microsoft first party token brokers to enable single sign-on (SSO) across the applications used on those devices.
When do refresh tokens expire?
The refreshtoken will expire after 90 days. So even if you store it like every 10 days you will be good. But you should store the received tokens every time when the tokens have changed (when the process actually went to the authentication servers).