2 ms·
You (typically) only get a refresh token if you ask for offline access in your request scope AFAIK. It's not the default (online is).
by candiddevmike 2y ago
You (typically) only get a refresh token if you ask for offline access in your request scope AFAIK. It's not the default (online is).
- taeric 2y agoFor AWS Cognito's Token endpoint? Where is that documented? I'm also not seeing that behavior, as I don't have that in my scope and I do get a refresh token if I do the CODE flow.
- candiddevmike 2y agoI'm referring to the openid standard I guess[1], it looks like AWS Cognito does something different (they don't support offline_access, but they always issue a refresh_token from what I'm reading). 1 - https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess https://openid.net/specs/openid-connect-core-1_0.html#Offlin...
- taeric 2y agoYeah, if you do a CODE flow, you get three tokens. Implicit is only access. They at least have decent support to guard api access using these.