Usage of refresh token

When an access Token obtained by client application has expired, client application can utilize "refresh Token” To obtain a new access Token.Client application can make a HTTP Post request (from server side – aka not from browser as this request requires passing client secret) at OpenID Connect/OAuth Token Server to obtain a new access token. Parameters will be client id, client secret, grant_type = refresh_token and refresh_token.

HTTP response code received on refresh token request	Description
200	Client authentication successful, refresh token is valid. Response contains new access token along with expires_in for the new token.
400	Bad request – implying either invalid or expired refresh token or one of the desired input parameters are missing in request.
401	Client authentication failure – invalid client_id or client_secret.

Additional information:

• There is no restriction to how many numbers of times a client application can reuse refresh token, as long as refresh token is valid it can be used endlessly however as a best practice – client application should use refresh token only when the previously obtained access token has expired.
• As a best practice – client application should use refresh token only when the previously obtained access token has expired.
• The “expires_in” for access token obtained from the use of refresh token will mostly be same as the original access token obtained – however it’s advisable for client application to be dynamic enough and read the “expires_in” value every time a new access token is obtained and accordingly schedule the refresh task.