Understanding Google OAuth2 Refresh tokens

Question

I previously worked on an OAuth2 application where the logic was to generate a new access token via refresh token once the old one expired.

Now working with Google APIs, I'm not experiencing the same thing. I have received both an access token and refresh token, and after allowing the access token to expire, I attempt to use the refresh token

               var myToken = new TokenResponse
            {
                RefreshToken = sRefreshToken
            };

            var credentials = new UserCredential(new GoogleAuthorizationCodeFlow(
              new GoogleAuthorizationCodeFlow.Initializer
              {
                  ClientSecrets = new ClientSecrets
                  {
                      ClientId = clientId,
                      ClientSecret = clientSecret
                  }
              }), "user", myToken);

            service = new CalendarService(new BaseClientService.Initializer()
            {
                HttpClientInitializer = credentials,
                ApplicationName = "XYZ",
            });

It seems after doing so I can make API calls. But I have tried to retrieve the access/refresh tokens after doing this with:

            ACCESS_TOKEN = credentials.Token.AccessToken;
            REFRESH_TOKEN = credentials.Token.RefreshToken;

And both the access and refresh tokens are the same as the old ones. I had thought refreshing would generate a new token altogether? Is this not the case?

If the access token expires after 30 minutes and you then just need to pass in the refresh token (but nothing re-generates), what is the point of the refresh token?

Johannes Passing Johannes Passing · Accepted Answer · 2021-06-12T15:38:23

I previously worked on an OAuth2 application where the logic was to generate a new access token via refresh token once the old one expired.

This idea also applies to Google access/refresh tokens. But if you're using the .NET client library (as your code snippet suggests), you don't have to perform the refreshes yourself. You can just continue using the UserCredential object and it'll automatically fetch a new access token every ~1h.

Understanding Google OAuth2 Refresh tokens

1 Answers