The previous articles in this series built a working OIDC Authorization Code Flow server , fixed the hardcoded issuer , discussed persistent signing keys , and added a consent screen . Now it's time to tackle the refresh token grant.

Access tokens are short-lived by design (~30 minutes - 90 minutes). Once they expire, the client needs a new one. Without refresh tokens, that means sending the user back through the login and consent flow every hour. That makes a TERRIBLE experience for long-lived sessions like a mobile app or a background service. Can you imagine having to log in (user + password) every hour just to open your email app?

The refresh token grant solves this.

After the user authenticates and grants consent, the server issues a long-lived refresh token alongside the short-lived access token. The client stores the refresh token securely and exchanges it for a new access token whenever the old one expires.…