Get hands-on experience with 20+ free Google Cloud products and $300 in free credit for new customers.

Why do I not see a refresh_token for a token acquired via client_credentials?

I currently have an API proxy for generating and revoking OAuth2 access tokens.

In this proxy, there are flows for each operation (Generation, Revocation and Refresh).

I created a policy for generating access_token using client_credentials grant type, a policy for revoking access_token and a policy for refreshing access_token, each applied to the request field of each flow.

The problem I'm having is that when I do a request to the endpoint of the flow responsible for generating access_token (/oauth2/access_token), I only get the access_token. According to Apigee documentation, client_credentials can't generate refresh_token alongside the access_token.

The other problem is that the body of my "Refresh Access Token" policy doesn't return anything, even though I enabled the "GenerateResponse" option.

In my organization, we need to authenticate the client application without using a password and being able to extend the lifespan of the access_token without the user re-authenticating.

How should I proceed?

0 1 508
1 REPLY 1
Top Solution Authors