Cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

'Refresh token' invalidated when asking for a new 'access token'?

When I request a new 'access token' using the 'refresh token' I got before, it gets invalidated, so I'm forced to record not only the 'access token' I am requesting, but also a new 'refresh token'. Is this ok? Am I doing something wrong?

This is the specific part of code of my request. FYI (I colored in red what I have to do but not expected to do)

OAuthClientRequest request = OAuthClientRequest
					.tokenLocation(getApiBaseUrl() + "/oauth2/token")
					.setGrantType(GrantType.REFRESH_TOKEN)
					.setRefreshToken(tokens.getRefreshToken())
					.buildBodyMessage();

			String asB64 = Base64.getEncoder().encodeToString(
					(fitbitClientId + ":" + fitbitClientConsumerSecret)
							.getBytes("utf-8"));

			request.setHeader("Authorization", "Basic " + asB64);
			OAuthClient oAuthClient = new OAuthClient(new URLConnectionClient());

			OAuthResourceResponse resourceResponse = oAuthClient
					.resource(request, OAuth.HttpMethod.POST,
							OAuthResourceResponse.class);

			if (resourceResponse.getResponseCode() == HttpServletResponse.SC_OK) {
				JSONObject jsonObject = new JSONObject(
						resourceResponse.getBody());
				tokens.setAccessToken(jsonObject.get("access_token").toString());
				tokens.setRefreshToken(jsonObject.get("refresh_token").toString());

Thanks!

 

Best Answer
0 Votes
1 REPLY 1

The refresh token can only be used once. When you exchange it for a new access token, a new refresh token is also granted.

Best Answer
0 Votes