Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Not getting refresh token in YouTube OAuth

I am doing server side OAuth following this guide.

I successfully completed the OAuth, but am not getting a refresh_token in the step Exchange authorization code for refresh and access tokens:

Request:

POST /o/oauth2/token HTTP/1.1
HOST: accounts.google.com
content-type: application/x-www-form-urlencoded
content-length: 260

code=4/KEOuzih9jwfnHj7Rl1DeqHhcJF0goKPwtwR5IQ09ieg&
client_id=****.apps.googleusercontent.com&
client_secret=****&
redirect_uri=http%3A%2F%2Flocalhost%3A8000%2FsSignIn.html&
grant_type=authorization_code

Response:

{
  "access_token" : "****",
  "expires_in" : 3580,
  "token_type" : "Bearer"
}

Am I missing something?

like image 457
Abhishek Gupta Avatar asked Nov 25 '16 19:11

Abhishek Gupta


People also ask

How do I get the OAuth refresh token?

To get a refresh token, you must include the offline_access scope when you initiate an authentication request through the /authorize endpoint. Be sure to initiate Offline Access in your API. For more information, read API Settings.

Can not get refresh token?

The refresh_token is only provided on the first authorization from the user. Subsequent authorizations, such as the kind you make while testing an OAuth2 integration, will not return the refresh_token again. :) Go to the page showing Apps with access to your account: https://myaccount.google.com/u/0/permissions.

How do I get new token with refresh token?

To get an access token using a refresh token, you must first get the refresh token. Then you use the refresh token from then on to generate an access token.


1 Answers

Two things needed to be done:

  1. To get refresh token, you have to pass access_type=offline as query parameter to the oauth start request. This will make sure you get the refresh token when doing the oauth for the first time for the account.
  2. To get the refresh token on doing the oauth again and again for the same account, you have to pass prompt=consent as query parameter to the oauth start request.

Reference: https://developers.google.com/identity/protocols/OAuth2WebServer#offline

like image 56
Abhishek Gupta Avatar answered Oct 13 '22 06:10

Abhishek Gupta