Section 1.5 Introduction of refresh _token states: Refresh tokens are issued to the client by the authorization server and are used to obtain a new access token when the current access token becomes invalid or expires, or to obtain additional access tokens with identical or narrower scope (access tokens may have a shorter lifetime and fewer …
refresh_token — Your refresh token for the application. This token must be kept secure. refresh_token_expires_in — The number of seconds remaining until the refresh token expires. Refresh tokens usually have a longer lifespan than access tokens. Sample Response, 11/13/2020 · B2C also provides a property refresh _token_ expires_in , but this is outside the OAuth standard. A client application can only check if the refresh token is valid by trying to use it. If authentication with the refresh token fails, the user will need to reauthenticate. The expiry in the example is 14 days, but B2C will most likely change it to 24 …
refresh_token: A token used when refreshing the access token. Max length: 512 characters: x_refresh_token_expires_in: The remaining lifetime, in seconds, for the connection, after which time the user must re-grant access. expires_in: The remaining lifetime of the access token in seconds. The value always returned is 3600 seconds (one hour).
On day 2, developer makes a refresh token API call using refresh token A, it will return access token X , refresh Token Z. That is, on day 2, a new refresh token is returned, and the refresh .
Refresh tokens have normally a very long expiration times relative to access tokens. Because refresh tokens are more valuable than access tokens they are usually only issued via the OAuth “Authorization Code Grant” flow.
What this means is that you can only use your refresh token one time before it expires [since a refresh generates both an access and refresh token, and only one of each can be active at a time], and that can be anywhere between the time of generation and 60 days later.
