what's the deal with refresh tokens?

[Kengiese]

Refresh tokens are said to be good for a year, then in the very next sentence you say they can only be used once and need to be replaced.  Don't you think this is a little in-congruent. I've been struggling with oauth2 for several weeks and I don't think it's my fault. Worst Designed API I've ever tried to deal with.

And the documentation is terrible. I thought I made a break through when I discovered you had built a wizard to help us through the process, then I found that the code the wizard provided didn't work either.

Obviously I'm missing something.  If anyone knows of a site that can untangle this mess, please let me know where it is.

[Kengiese]

I stumbled on the answer.  I kept missing the radio button to select authorization work flow instead of the default, implicit. Once I got that implicit access token without a refresh token I would go back and try to run the right work flow.  The authorization work flow would not work then because I had a valid access token already.  I had to back up and remove all access tokens and then proceed again with the authorization work flow.  I don't remember ever seeing a warning about this so it might be worth mentioning in the documentation to save others the frustration of seeing the wizards curl fail with no explanation of why.

[Gondwana]

I'm glad you found the answer.

In future, you may get more traction in this section of the forum.