Refresh Tokens with OIDC

• Will no longer be returned when using the implicit grant for authentication.
• Can be used by confidential applications.
• Can be used with Refresh Token Rotation by public applications when using the Authorization Code Flow with PKCE.
• Should use the /oauth/token endpoint to get new tokens because the /delegation endpoint is deprecated.

​

Legacy (delegation)

POST /delegation
Content-Type: 'application/json'
{
  "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
  "client_id": "...",
  "refresh_token": "...",
  "scope": "openid profile"
}

​

OIDC-conformant (token endpoint)

POST /oauth/token
Content-Type: application/x-www-form-urlencoded
grant_type=refresh_token&refresh_token=123&client_id=123&client_secret=123&scope=openid+profile&audience=https%3A%2F%2Fapi.example.com

• audience and client_secret parameters are optional.
• client_secret is not needed when requesting a refresh_token for a public application.

​

Learn more

• Access Tokens with OIDC
• External APIs with OIDC
• Authorization Code Flow with OIDC
• Client Credentials Flow with OIDC
• Delegation with OIDC
• Implicit Flow with OIDC