Android : Refresh token not returned in OAuth Microsoft cloud health API

0
votes

After hitting the login URL of Microsoft band with my credentials, i am redirected to a URL which contains the access token but it doesn't return the refresh token for the authorisation scope (offline_access). Do we have to make any changes in the Microsoft account for offline access ?

Note : offline_access scope missing in redirected URL

Login URL : (To get access token)

https://login.live.com/oauth20_authorize.srf?client_id=0000000067E8E&scope=offline_access mshealth.ReadDevices mshealth.ReadActivityHistory&response_type=token &redirect_uri=https://login.live.com/oauth20_desktop.srf

Redirected URL

https://login.live.com/oauth20_desktop.srf?lc=1033#access_token=EwCgAvF0BAAUkWhN6f8bO0%2bg89MA1fmZueWyRkQAAe%2bPpQEZi2ny0/0knttDAVbenK3VDVzYzmD7HRVQ2rZXp9hSbJE1VvXse%2bZW0IoWqVvgAdHmWleOmKHhB3E4eJ220ztjozrqyxA0Vo/T1/RzW8U2f%2b5FQp6YKnPCXPIOenPz9XqHBapvzZkRTXO666VuJ7cjgcmQ7ANIJyMdu6J1DmEmp5B2pbLlRf/RxGFDzQEuhdHE68ExKtdRgXNGquW9fwKx6uG4Np6tCHebbzOUoY8/oHLS7x/eNUPYJUKMJweljI3FVOBUnaiYfMSY/AUFBvPvjrIoyQIjTmEG81vn3jIbhUVOuC/BTAZcm0aW3tZQLor9TLmd/uDg/P5jPZsDZgAACKznE0lStQmJcAFKavrO1/U7NXE1zzCSj2MHf867kmZ62UNwUmOqfbBHbFmFaNyqLq5d7Brv/RuIKV321t8OEcE8jUp65D9rjTp3jSYWnKP2mwib%2bvOpdtctN41yoCr%2bk8gKcyALtB%2bYbpxAFrN5J471XLzXy0doOCbOmjbU%2bYKy1mZI/j%2b0Hvn7JSL9B3DC1/YqfF21OjjzT8Xtil5Av/kVCpr8KIYpfzxVP4YqavxU1xriw2c4hR1uN%2b9dp4NuurxpeJb%2boUJ9LgikZN3rX2iB4n5e5VxtH0jRPujZd0nTRA8kwhJJzlgrIGsBDoqEDp8xp9KqkUEZ7%2bevvhbRD/9O5x6/4g%2biPORgicWqTEQ4XxvV5LKaeZq4rKxaDemmNI92yHjSjYA2WQNidbjEmRmelA221Sn2AFqp77uOD7%2bTitoXzOPWMrqLjGkcOH9UQdYA9uXbSPvQ7g1AwUPtlB7Y2fh0JlzBa7OyGrzai9mHJ1jmyXRj76/naI0B&token_type=bearer&expires_in=3600&scope=mshealth.readactivityhistory%20mshealth.readdevices&user_id=2c6adaf29f64fe0d0d72670f90c67080

1
androidoauthoauth-2.0microsoft-band

1 Answers

1
votes

You're trying to use 'response_type=token' but the Microsoft Health API uses the 2-step 'response_type=code' authentication flow. See section 4.8 of the Getting Started guide. The redirect URL for the first call contains the authorization code as a query parameter. You use that code in a second call which returns a JSON response body containing the access token and (if offline_access scope was requested) a refresh token.