topic Re: Refresh token revoked in Spotify for Developers

Refresh token revoked

chrishipgrave — Mon, 19 Apr 2021 09:04:13 GMT

I am using PKCE for my web app. When a user tries to perform an action and the access token has expired, I use the refresh token to generate a new access token. If my webapp is idle for over a day, and I try to use the refresh token, I get the following: oken

status: 400

error: 'Refresh token revoked'

I cannot see anywhere online which mentions the refresh token automatically getting revoked. Should this happen? Do I need to get the user to re-auth when it does happen?

Re: Refresh token revoked

Hubo — Mon, 19 Apr 2021 12:41:17 GMT

Hey @chrishipgrave, thanks for your post here!

Hmm, I have taken a look and it seems that this might happen due to the following reasons:

- A refresh token that has been obtained through PKCE can be exchanged for an access token only once, after which it becomes invalid.

- The user revoked this app from their account

Could you let me know if any of these reasons are the case? Keep me in loop!

Happy coding,

Hubo

Re: Refresh token revoked

chrishipgrave — Mon, 19 Apr 2021 12:53:39 GMT

Hi @Hubo,

Thanks for the reply. It's definitely not the secon point but could be the first. What I am doing is using setTimeout to trigger teh refresh token call after a certain time. Maybe if the user has closed their laptop or something it could cause the setTimeout to not fire. Any thoughts on that?

axios.post(`https://accounts.spotify.com/api/token`, params, config) .then(response => { let access_token = response.data.access_token let refresh_token = response.data.refresh_token let expires_in = response.data.expires_in commit('SET_ACCESS_TOKEN', access_token) commit('SET_REFRESH_TOKEN', refresh_token) dispatch('initPlayer') let now = new Date() now.setSeconds(now.getSeconds() + expires_in); commit('SET_EXPIRES_AT', now) let timeout = (expires_in * 1000) - 10000 console.log('settimeout') setTimeout(() => { console.log('timeout triggered') dispatch('refreshToken') }, timeout) })

Re: Refresh token revoked

martinweiss — Tue, 30 Jan 2024 03:56:04 GMT

Hi Hubo,

I am having the same issue. I want to get a refresh token every so often and use that refresh to get a new access token to get my recently played songs. Do you have any advice? I am using Python. Thanks!