topic Re: Authorization Code Flow Refresh Tokens in Spotify for Developers

Authorization Code Flow Refresh Tokens

jhyde01 — Tue, 29 Jun 2021 14:37:31 GMT

I am building an application which requires the refreshing of user Spotify stats (followers, playlists, etc) on a weekly basis. About two months after a user gives my web application access to their Spotify, I begin to get errors regarding the token no longer being valid, and when I attempt to refresh the token am not able to.

The documentation states "A new refresh token might be returned too." on https://community.spotify.com/t5/forums/postpage/board-id/Spotify_Developer

Under what circumstances will a new refresh token be provided when you refresh a token?

Is there anyway around this to always get a new refresh token?

Re: Authorization Code Flow Refresh Tokens

Peter_Schorn — Wed, 30 Jun 2021 00:12:23 GMT

Because the documentation does not specify when a new refresh token is returned, your app should always check if a new one is returned after you refresh the access token. If a new refresh token is returned then you should replace the old one with the new one in your persistent storage. Are you doing this?

Try using the Authorization Code Flow with Proof Key for Code Exchange, which always returns a new refresh token after you refresh the access token.

Re: Authorization Code Flow Refresh Tokens

jhyde01 — Thu, 01 Jul 2021 19:27:10 GMT

Yes I am always storing the refresh token if it comes back. I will check out the PKCE way of doing things and see if that works.