Google oauth get refresh_token using js api

Question

My application needs to signup users using Google plus and then display the user's profile data. When the user edits their profile on Google plus and visits my application again, the app needs to show the updated data. Hence the application needs to store the access_token and refresh_token for future use. I want to manage all this using google's js api without any server side google-api-client.

The problem is that I am unable to retrieve the refresh_token using the js api. I have setup a jsfiddle here. The google plus related code is as follows:

$('#signInButton').click(function () {
  attributes = {
    'accesstype': 'offline',
    'clientid': "260932337012-1gdbsh3p7oknkjmeaa7m9q7e6nhhgd9c.apps.googleusercontent.com",
    'scope': 'email profile',
    'cookiepolicy': 'single_host_origin',
    'approvalprompt': 'force',
    'callback': signInCallback
  };

  gapi.auth.signIn(attributes);
});

function signInCallback(authResult) {
  alert(authResult.request_token);
}

The refresh_token is not returned inspite of setting accesstype to offline. What am I doing wrong here?

Thanks in advance.

This is no answer (sorry) but I am in a similar boat of trying to figure out a troubling issue with Google API Rest Service and getting little help myself. — kstubs
@kstubs I could not find a pure js way. Google's documentation suggests something called a one time code flow. It involves fetching the access_token and code using the js api and then using a server side google library to exchange the code for a refresh_token. If you are using ruby, then the following code should. Alternately you could read google's documentation here word by word. — Alex
Thanks Alex. This is a possibility (sort of) not exactly what I am trying to accomplish today though. Good luck! — kstubs

fpghost fpghost · Accepted Answer · 2014-11-16T12:02:31

It's impossible to obtain a refresh token using purely the client-side flow with javascript browser based apps. This is a security feature when using the implicit grant type of OAuth 2.0.

The refresh token is for server-side or hybrid flows only.

With javascript only you'll simply need to signin the user again, or if they haven't signed out you can use the 'immediate': true parameter to authenticate them behind the scenes, i.e. without presenting them with another UI popup.

Google oauth get refresh_token using js api

1 Answers