We changed our privacy policy. Read more.

New answers tagged

1

You don't have to use refresh tokens. The client could ask for username/password every time (which is annoying to the end user), or store the credentials, with the risk of leaking them. Passwords are often reused, so leaking one is rather dangerous. A refresh token is only valid for a single API, has a limited validity period (which can be controlled by the ...


Top 50 recent answers are included