How to use the Refresh Token <redux>

[paulm]

Hi.

I'm trying to utilise the refresh_token functionality on my nodejs backend but am not having any luck.

I haven't found any documentation for its use and there is no JS library function for it, so I've tried to do it myself based on details in this post:

How to use the Refresh Token?

For the record, here’s the curl version. Requirements: You need a refresh token that is associated with an OAuth client. The grant type refresh_token won’t work with a regular refresh token generated using the particle:particle credentials. Then, you can fetch your new credentials like this: curl https://api.particle.io/oauth/token \ -d grant_type=refresh_token \ -d refresh_token='<your-refresh-token>'

So just trying it from the command line using:
curl --trace - https://api.particle.io/oauth/token -d grant_type=refresh_token -d refresh_token='BLAHBLAHFAKEBLAHBLAH'
I get a 400 back from the Particle cloud with this message:
{"error":"invalid_client","error_description":"Invalid or missing client_id parameter"}

Has anyone figured this one out yet, or know where there's other documenation?

Thanks.

[rickkas7]

The refresh token is essentially unusable. You need to supply the client ID and secret, which makes it basically the same as a new grant, so there’s really no reason to use the refresh token.

Just create a non-expiring access token, or create a new token, instead.

[paulm]

Ahhhh… I did see that the oAuth spec called for the client id and secret in this message but thought it surely wouldn’t be necessary as it didn’t make sense from a security POV.

Thanks for the fast reply Rick.