Reputation: 16354
Since using the refresh token gives you a new pair of tokens, what is the advantage of doing a refresh versus just obtaining a new Auth token? For example:
Why not just get a new access token each time?
If I am doing everything within my own server / within my own code, is there any benefit to refreshing. Or is it as good to obtain a new token every hour?
I get the gist of the refresh in some circumstances, but when it's all in my control, is refresh token necessary?
Upvotes: 1
Views: 151
Reputation: 13069
Advantage relies with easiness of obtain access token.
Think about Authorization code flow. If you do not get a refresh token, client application have to trigger a new authorization code flow to retrieve a new access token. This include end user interactions for user grants (end user login in simple terms). For some applications, such re-login is not a desired feature. For them having a refresh token is a very desirable feature.
So when you design your application, if you don't want your end users to provide their credentials every time client application want an access token, then you should use refresh token. But if this is not the case and you have other ways to complete access token obtaining process then it's rather a design decision.
Upvotes: 1