OAuth2 client-side flow no refresh token?

Question

OAuth2 client-side flow no refresh token?

I am using an android app. The user logs in but the refresh token is missing?

Does that mean after one hour when the token expires, the user needs to login again?

So how do I keep the user logged in?

Answer 1

My guess would be that if the server isn't sending a refresh token, then the the access token is permanent (similar to OAuth 1.0).

Answer 2

You need to mention which OAuth provider are you talking about. Some providers, like Facebook, do not have Refresh tokens but they rely on rather long lasting access tokens.

Most providers do provide Refresh tokens though. It'd be much easier to answer this if you mention the provider details. Anyway, this information (refresh token or no refresh token) would definitely be available in the provider's OAuth documentation. Good luck.