I am doing server side OAuth following this guide.
I successfully completed the OAuth, but am not getting a refresh_token
in the step Exchange authorization code for refresh and access tokens:
Request:
POST /o/oauth2/token HTTP/1.1
HOST: accounts.google.com
content-type: application/x-www-form-urlencoded
content-length: 260
code=4/KEOuzih9jwfnHj7Rl1DeqHhcJF0goKPwtwR5IQ09ieg&
client_id=****.apps.googleusercontent.com&
client_secret=****&
redirect_uri=http%3A%2F%2Flocalhost%3A8000%2FsSignIn.html&
grant_type=authorization_code
Response:
{
"access_token" : "****",
"expires_in" : 3580,
"token_type" : "Bearer"
}
Am I missing something?
To get a refresh token, you must include the offline_access scope when you initiate an authentication request through the /authorize endpoint. Be sure to initiate Offline Access in your API. For more information, read API Settings.
The refresh_token is only provided on the first authorization from the user. Subsequent authorizations, such as the kind you make while testing an OAuth2 integration, will not return the refresh_token again. :) Go to the page showing Apps with access to your account: https://myaccount.google.com/u/0/permissions.
To get an access token using a refresh token, you must first get the refresh token. Then you use the refresh token from then on to generate an access token.
Two things needed to be done:
access_type=offline
as query parameter to the oauth start request. This will make sure you get the refresh token when doing the oauth for the first time for the account.prompt=consent
as query parameter to the oauth start request.Reference: https://developers.google.com/identity/protocols/OAuth2WebServer#offline
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With