We changed our privacy policy. Read more.

New answers tagged


You don't have to use refresh tokens. The client could ask for username/password every time (which is annoying to the end user), or store the credentials, with the risk of leaking them. Passwords are often reused, so leaking one is rather dangerous. A refresh token is only valid for a single API, has a limited validity period (which can be controlled by the ...

Top 50 recent answers are included