OAuth 2.0 call to Refresh Token not working

[ibiss2016]

Hi,

We are currently migrating to OAuth 2.0 and all is working well except for the Refresh Token call (Authorization Code Grant Flow).

We are creating access tokens successfully, then when we get a 401 'expired_token' we call Refresh Token (using the refresh_token returned in the access token response), but it always returns a 400 'invalid_grant'.

Conversely, if we make a call to Refresh Token before the access token has expired, it works and returns a new access token.

Is this a bug, or are we missing something?

Many thanks!

[JeremiahFitbit]

invalid_grant is the errorType. What does the "message" property in the error object say?

[ibiss2016]

Hi Jeremiah,

Thanks for getting back.  Looks like it was a fault our side, we were calling the Revoke API to invalidate the token, then trying to refresh it.  D'oh!... revoke obviously revokes access, so no wonder the refresh token was invalid.

Anyway, without revoking and letting the token expire naturally, the Refresh call works and we've now migrated our users 🙂

Btw, thanks for updating the documentation about the 'expires_in' param - but it looks like the access token always returns 'expires_in' as 28800, even when you explicitly pass in 'expires_in' as 3600 to the Access Token request.  

Also is there a mechanism to expire tokens for testing, maybe a shorter time period for expires_in?

Thanks again.

[JeremiahFitbit]

1 hour is the shortest time, but you don't need to wait for the access token to expire in order to use the refresh token to obtain a new access token.