Refresh Token

Environment and endpoints

Production issuer is https://accounts.appforges.com; staging is https://accounts-staging.appforges.com. Browser authorization uses the issuer's /oauth2/authorize, and token exchange uses /oauth2/token. Business APIs use the matching API domain. Do not use REST /v1/oauth/authorize as a browser login URL.

Create an OAuth client in application Credentials with Public/Confidential mode, redirect URIs and allowed scopes. Copy the actual client_id; app_id is a different identifier. Public clients use PKCE S256 without client_secret; Confidential secrets stay on secure backends.

Refresh user authorization

Refresh only when the actual token response includes refresh_token and the client permits that grant. Send form-encoded grant_type=refresh_token, refresh_token and client_id to the same issuer's /oauth2/token, authenticating as registered.

Atomically replace secure storage if a new refresh_token is returned. Serialize concurrent refreshes for the same authorization to prevent stale tokens overwriting new ones. Honor expires_in. Reauthorize after refresh failure rather than retrying without bounds. Never place refresh tokens in browser URLs or logs.

See user authorization and errors and retries.