Multiple Active Refresh Tokens

[john__]

Im developing an OS X app and have noticed that the refresh tokens are invalidated after spawning another token.

This invalidates logins on other computers.

What methods can I use to get around this?

Thanks

[JeremiahFitbit · Accepted solution]

A Mac OS X app is considered a "public client" by OAuth 2.0's definition:

public
      Clients incapable of maintaining the confidentiality of their
      credentials (e.g., clients executing on the device used by the
      resource owner, such as an installed native application or a web
      browser-based application), and incapable of secure client
      authentication via any other means.

Because it is not possible for a public client to keep your client secret truly a secret, your app should be using the Implicit Grant Flow instead of the Authorization Code Grant Flow. The Implicit Grant Flow allows for access tokens up to 1 year, but does not have a refresh token flow.

If you would like to use the Authorization Code Grant Flow, you will need to create a Web service that continually refreshes the access token and returns it securely to each instance of a Mac OS X app.

[john__]

Thanks!, I will ammend!

btw the app is 'FitJet':

https://itunes.apple.com/us/app/fitjet-for-fitbit/id1104115783?mt=12