Recommended flow for getting refresh_token for server side usage

[macdja38]

In our app a significant portion of the flow will involve the server taking action on behalf of the user, to accomplish this we need to get a refresh token when the user logs in, and be able to put it on the server. What's the recommended flow using this library to do something like that?

I've gotten the access token locally on the device, but I'm unsure of how to get the refresh token.

So far I've been thinking of changing the customScheme to be a URL on the remote server then having the user login using that, then redirecting back to the app by redirecting to the actual local customScheme URL once that's done. Not sure what to do to pass the cookie from the server / some other auth method to the actual app code at that point though.

[macdja38]

So far it seems we have a refresh token available here but it's never passed back out to the js code.

[moberwasserlechner]

If it’s that what you need I think I‘m currently developing that for #41. I guess you do not use the resourceUrl. Can you plz share your config and which provider you’re trying to use?

…

Am 24.06.2019 um 22:53 schrieb Jake ***@***.***>: So far it seems we have a refresh token available here but it's never passed back out to the js code. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[macdja38]

Thanks for the reply, for now I've removed the resourceUrl and that gets me the response_token, I've yet to determine if that response token works once I send it to the server, but I think that should solve my issue.

The documentation for the options could definitely use a bit more info about what happens when you leave out the resourceUrl though.

(I am using the 1.1.0 updated branch)

For our use case though It would definitely be ideal to be able to get the code back into js code space then allow the caller of this library to handle it itself. In our case we would love to get the code and send it server side, allowing our server to fetch the refresh / authorization token, then sending back the necessary data.

[moberwasserlechner]

The documentation for the options could definitely use a bit more info about what happens when you leave out the resourceUrl though.

This is currently under dev but I'm happy to accept a PR for documentation improvements. Your contribution is very welcome. ;)

For our use case ...

I think that's the same requirement I want to do in #13. If it's not a duplicate let me know. It's planed but I will not be able to work on it before September.

[moberwasserlechner]

Duplicates #13