You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: articles/api/authentication/api-authz/_refresh-token.md
+2-177
Original file line number
Diff line number
Diff line change
@@ -57,7 +57,7 @@ Content-Type: application/json
57
57
58
58
Use this endpoint to refresh an <dfndata-key="access-token">Access Token</dfn> using the <dfndata-key="refresh-token">Refresh Token</dfn> you got during authorization.
59
59
60
-
###Request Parameters
60
+
## Request Parameters
61
61
62
62
| Parameter | Description |
63
63
|:-----------------|:------------|
@@ -67,181 +67,6 @@ Use this endpoint to refresh an <dfn data-key="access-token">Access Token</dfn>
67
67
|`refresh_token` <br/><spanclass="label label-danger">Required</span> | The refresh token to use. |
68
68
|`scope`| A space-delimited list of requested scope permissions. If not sent, the original scopes will be used; otherwise you can request a reduced set of scopes. Note that this must be URL encoded. |
request(options, function (error, response, body) {
107
-
if (error) throw new Error(error);
108
-
109
-
console.log(body);
110
-
});
111
-
```
112
-
113
-
> RESPONSE SAMPLE:
114
-
115
-
```JSON
116
-
HTTP/1.1 200 OK
117
-
Content-Type: application/json
118
-
{
119
-
"access_token": "eyJz93a...k4laUWw",
120
-
"id_token": "eyJ...0NE",
121
-
"refresh_token": "eyJ...MoQ",
122
-
"expires_in":86400,
123
-
"token_type":"Bearer"
124
-
}
125
-
```
126
-
127
-
<%= include('../../../_includes/_http-method', {
128
-
"http_badge": "badge-success",
129
-
"http_method": "POST",
130
-
"path": "/oauth/token",
131
-
"link": "#token-exchange-native-social"
132
-
}) %>
133
-
134
-
:::warning
135
-
This flow is intended for use with native social interactions **only**. Use of this flow outside of a native social setting is highly discouraged.
136
-
:::
137
-
138
-
When a non-browser-based solution (such as a mobile platform's SDK) authenticates the user, the authentication will commonly result in artifacts being returned to application code. In such situations, this grant type allows forthe Auth0 platform to accept artifacts from trusted sources and issue tokensin response. In this way, apps making use of non-browser-based authentication mechanisms (as are common in native apps) can still retrieve Auth0 tokens without asking for further user interaction.
139
-
140
-
Artifacts returned by this flow (and the contents thereof) will be determined by the `subject_token_type` and the tenant's configuration settings.
141
-
142
-
### Request Parameters
143
-
144
-
| Parameter | Description |
145
-
|:-----------------|:------------|
146
-
| `grant_type` <br/><span class="label label-danger">Required</span> | Denotes the flow you are using. For Token Exchange for Native Social, use `urn:ietf:params:oauth:grant-type:token-exchange`. |
|`audience`| The unique identifier of the target API you want to access. |
151
-
|`scope`| String value of the different <dfn data-key="scope">scopes</dfn> the application is requesting. Multiple scopes are separated with whitespace. |
152
-
|`user_profile`<br/><span class="label label-info">Only For `apple-authz-code`</span>| Optional element used fornative iOS interactions for which profile updates can occur. Expected parameter value will be JSONin the form of: `{ name: { firstName: 'John', lastName: 'Smith }}` |
153
-
154
-
### Request Parameters
155
-
156
-
| Parameter | Description |
157
-
|:-----------------|:------------|
158
-
| `auth0-forwarded-for` | End user IP as a string value. Set this if you want brute-force protection to work in server-side scenarios. To learn more about how and when to use this header, read [Using resource owner password from server-side](/api-auth/tutorials/using-resource-owner-password-from-server-side). |
159
-
160
-
### Remarks
161
-
162
-
- The <dfn data-key="scope">scopes</dfn> issued to the application may differ from the requested scopes. In this case, a `scope` parameter will be included in the response JSON.
163
-
- If you don't request specific scopes, all scopes defined forthe audience will be returned due to the implied trust to the applicationin this grant. You can customize the scopes returned in a rule. To learn more, read [Calling APIs from Highly Trusted Applications](/api-auth/grant/password).
164
-
165
-
### Learn More
166
-
- [Add Sign In with Apple to Native iOS Apps](/connections/apple-siwa/add-siwa-to-native-app)
167
-
- [iOS Swift - Sign In with Apple Quickstart](/quickstart/native/ios-swift-siwa)
Use this endpoint to invalidate a <dfn data-key="refresh-token">Refresh Token</dfn>if it has been compromised.
222
-
223
-
The behaviour of this endpoint depends on the state of the [Refresh Token Revocation Deletes Grant](https://auth0.com/docs/tokens/refresh-tokens/revoke-refresh-tokens#refresh-tokens-and-grants) toggle.
224
-
If this toggle is enabled, then each revocation request invalidates not only the specific token, but all other tokens based on the same authorization grant. This means that **all Refresh Tokens that have been issued for the same user, application, and <dfn data-key="audience">audience</dfn> will be revoked**.
225
-
If this toggle is disabled, then only the refresh token is revoked, while the grant is left intact.
226
-
227
-
### Request Parameters
228
-
229
-
| Parameter | Description |
230
-
|:-----------------|:------------|
231
-
|`client_id`<br/><span class="label label-danger">Required</span>| The `client_id` of your application. |
232
-
|`client_assertion`| A JWT containing a signed assertion with your application credentials. Required when Private Key JWT is your application authentication method.|
233
-
|`client_assertion_type`| The value is `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`. Required when Private Key JWT is the application authentication method.|
234
-
|`client_secret`| The `client_secret` of your application. Required when Client Secret Basic or Client Secret Post is the application authentication method. Specifically required for Regular Web Applications **only**. |
235
-
|`token`<br/><span class="label label-danger">Required</span>| The Refresh Token you want to revoke. |
236
-
237
-
### Remarks
238
-
239
-
- For non-confidential applications that cannot keep the Client Secret safe (for example, native apps), the endpoint supports passing no Client Secret but the application itself must have the property `tokenEndpointAuthMethod`set to `none`. You can do this either from the UI ([Dashboard > Applications > Application Settings](${manage_url}/#/applications)) or using the [Management API](/api/management/v2#!/Applications/patch_applications_by_id).
240
-
241
-
### Error Codes
242
-
243
-
For the complete error code reference for this endpoint refer to [Errors > POST /oauth/revoke](#post-oauth-revoke).
request(options, function (error, response, body) {
33
+
if (error) thrownewError(error);
34
+
35
+
console.log(body);
36
+
});
37
+
```
38
+
39
+
> RESPONSE SAMPLE:
40
+
41
+
```JSON
42
+
HTTP/1.1 200 OK
43
+
(empty-response-body)
44
+
```
45
+
46
+
<%= include('../../../_includes/_http-method', {
47
+
"http_badge": "badge-success",
48
+
"http_method": "POST",
49
+
"path": "/oauth/revoke",
50
+
"link": "#revoke-refresh-token"
51
+
}) %>
52
+
53
+
Use this endpoint to invalidate a <dfndata-key="refresh-token">Refresh Token</dfn> if it has been compromised.
54
+
55
+
The behaviour of this endpoint depends on the state of the [Refresh Token Revocation Deletes Grant](https://auth0.com/docs/tokens/refresh-tokens/revoke-refresh-tokens#refresh-tokens-and-grants) toggle.
56
+
If this toggle is enabled, then each revocation request invalidates not only the specific token, but all other tokens based on the same authorization grant. This means that **all Refresh Tokens that have been issued for the same user, application, and <dfndata-key="audience">audience</dfn> will be revoked**.
57
+
If this toggle is disabled, then only the refresh token is revoked, while the grant is left intact.
58
+
59
+
## Request Parameters
60
+
61
+
| Parameter | Description |
62
+
|:-----------------|:------------|
63
+
|`client_id` <br/><spanclass="label label-danger">Required</span> | The `client_id` of your application. |
64
+
|`client_assertion`| A JWT containing a signed assertion with your application credentials. Required when Private Key JWT is the application authentication method.|
65
+
|`client_assertion_type`| The value is `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`. Required when Private Key JWT is the application authentication method.|
66
+
|`client_secret`| The `client_secret` of your application. Required when Client Secret Basic or Client Secret Post is the application authentication method. Specifically required for Regular Web Applications **only**. |
67
+
|`token` <br/><spanclass="label label-danger">Required</span> | The Refresh Token you want to revoke. |
68
+
69
+
## Remarks
70
+
71
+
- For non-confidential applications that cannot keep the Client Secret safe (for example, native apps), the endpoint supports passing no Client Secret but the application itself must have the property `tokenEndpointAuthMethod` set to `none`. You can do this either from the UI ([Dashboard > Applications > Application Settings](${manage_url}/#/applications)) or using the [Management API](/api/management/v2#!/Applications/patch_applications_by_id).
72
+
73
+
## Error Codes
74
+
75
+
For the complete error code reference for this endpoint, refer to [Errors > POST /oauth/revoke](#post-oauth-revoke).
request(options, function (error, response, body) {
34
+
if (error) throw new Error(error);
35
+
36
+
console.log(body);
37
+
});
38
+
```
39
+
40
+
> RESPONSE SAMPLE:
41
+
42
+
```JSON
43
+
HTTP/1.1 200 OK
44
+
Content-Type: application/json
45
+
{
46
+
"access_token": "eyJz93a...k4laUWw",
47
+
"id_token": "eyJ...0NE",
48
+
"refresh_token": "eyJ...MoQ",
49
+
"expires_in":86400,
50
+
"token_type":"Bearer"
51
+
}
52
+
```
53
+
54
+
<%= include('../../../_includes/_http-method', {
55
+
"http_badge": "badge-success",
56
+
"http_method": "POST",
57
+
"path": "/oauth/token",
58
+
"link": "#token-exchange-native-social"
59
+
}) %>
60
+
61
+
:::warning
62
+
This flow is intended for use with native social interactions **only**. Use of this flow outside of a native social setting is highly discouraged.
63
+
:::
64
+
65
+
When a non-browser-based solution (such as a mobile platform's SDK) authenticates the user, the authentication will commonly result in artifacts being returned to application code. In such situations, this grant type allows forthe Auth0 platform to accept artifacts from trusted sources and issue tokensin response. In this way, apps making use of non-browser-based authentication mechanisms (as are common in native apps) can still retrieve Auth0 tokens without asking for further user interaction.
66
+
67
+
Artifacts returned by this flow (and the contents thereof) will be determined by the `subject_token_type` and the tenant's configuration settings.
68
+
69
+
## Request Parameters
70
+
71
+
| Parameter | Description |
72
+
|:-----------------|:------------|
73
+
| `auth0-forwarded-for` | End user IP as a string value. Set this if you want brute-force protection to work in server-side scenarios. To learn more about how and when to use this header, read [Using resource owner password from server-side](/api-auth/tutorials/using-resource-owner-password-from-server-side). |
74
+
| `grant_type` <br/><span class="label label-danger">Required</span> | Denotes the flow you are using. For Token Exchange for Native Social, use `urn:ietf:params:oauth:grant-type:token-exchange`. |
|`audience`| The unique identifier of the target API you want to access. |
79
+
|`scope`| String value of the different <dfn data-key="scope">scopes</dfn> the application is requesting. Multiple scopes are separated with whitespace. |
80
+
|`user_profile`<br/><span class="label label-info">Only For `apple-authz-code`</span>| Optional element used fornative iOS interactions for which profile updates can occur. Expected parameter value will be JSONin the form of: `{ name: { firstName: 'John', lastName: 'Smith }}` |
81
+
82
+
## Remarks
83
+
84
+
- The <dfn data-key="scope">scopes</dfn> issued to the application may differ from the requested scopes. In this case, a `scope` parameter will be included in the response JSON.
85
+
- If you don't request specific scopes, all scopes defined forthe audience will be returned due to the implied trust to the applicationin this grant. You can customize the scopes returned in a rule. To learn more, read [Calling APIs from Highly Trusted Applications](/api-auth/grant/password).
86
+
87
+
## Learn More
88
+
- [Add Sign In with Apple to Native iOS Apps](/connections/apple-siwa/add-siwa-to-native-app)
89
+
- [iOS Swift - Sign In with Apple Quickstart](/quickstart/native/ios-swift-siwa)
0 commit comments