Skip to main content

On making a refresh token request, a new refresh token is generated and the old refresh token is invalidated. If the new refresh token is somehow lost, there’s no way to recover. Is it possible to make the old refresh token stay valid for a grace period after it is used in making a refresh token call? 

Hi there @Shaan Vaidya — to my knowledge, this is not currently possible. I’m CCing @BridgetFinegan for any additional context here.

It would be nice to have something done that makes it easier to use refresh tokens without implementing a distributed lock in a serverless / multi-server environment. We’ve implemented OAuth with i.e. Salesforce and HubSpot and have been able to avoid that complexity because they don’t invalidate refresh tokens after a single use. Please consider adding a configuration option to your OAuth Apps that allow us to reuse refresh tokens. Regards.

Hi @opineadam, thank you for your insight! I recommend filling out a feature request form to our product team at this link: 

https://docs.google.com/forms/d/e/1FAIpQLSenwcCuQsDUZ0agkwnzxbKQ2pyp5NMi_jyhab1W7a2Q2nxw_A/viewform

Please reach out if you have any questions!

 

Reply


Terms & ConditionsCookie settings