Refresh access tokens safely

Use a refresh token when an access token expires and the customer’s grant is still valid. Refreshing does not show a consent screen. It preserves the original account and authorization boundary.

curl --fail-with-body "https://auth.shareai.now/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=refresh_token" \
  --data-urlencode "client_id=$SHAREAI_CLIENT_ID" \
  --data-urlencode "client_secret=$SHAREAI_CLIENT_SECRET" \
  --data-urlencode "refresh_token=$SHAREAI_REFRESH_TOKEN"

Store both replacements together#

1. Serialize refresh operations for the same customer authorization. One application request should perform the refresh while others wait.
2. Exchange the current refresh token once using the configured client authentication method.
3. Save the returned access token, replacement refresh token and expiry atomically.
4. Discard the old refresh token. Release waiting requests using the new access token.

Handle failure#

On invalid_grant, clear the unusable authorization and ask the customer to reconnect. A temporary service error is different from revoked consent: show a temporary failure and keep a bounded recovery path. Never loop through refresh indefinitely.

Requesting narrower scope#

An optional scope value can reduce permissions. It cannot add surcharge to an identity-only grant. Use the returned scope and expiry as the authority for the new token.

Next step#

Send chat requests with an OAuth access token