We have several endpoints which were authenticated using a bearer access-token. There was another endpoint which will renew/generate a new bearer access-token on passing valid secret_id and client_id.
Now a client is asking for a new endpoint which will give them their already generated bearer access-token as a response from DB on passing valid secret_id and client_id but I feel that it was wrong to have such an endpoint based on several other APIs that I have used in the past.
Are there any drawbacks on providing such an endpoint? Are there any security issues that i should be worried about?