Im using a 3rd party api server side, which generates an access_token and a refresh_token as per normal via a grant_type=password request. I'm confused because this api does not appear to support grant_type=refresh_token - I keep getting the unsupported grant type error. Does it even matter, when you can just handle unauthorized errors by re-firing the password grant request? is this typical for 3rd party api use?
Add a comment
|
1 Answer
The reason that the resource owner password credentials grant issues a refresh token, is so that the client does not have to keep the password around in clear text for later use.
The client is supposed to collect username and password, use it to get an access and refresh token and discard the password.
Make sure to send a POST request with Content-Type set to application/x-www-form-urlencoded and include client credentials in a basic authorization header if your authorization server requires it. See RFC-6749 for an example.
