User Profile
Mathijsdb
3
Posts
0
Kudos
0
Solutions
21-05-2024
11:30
Ah ok. In your case the behavior seems logical to me: - Refresh token is not renewed at all because your setting is 'Re use' - Expiration is set to '30 days' - With every new access token, the refresh tokens remains equal to the 1st one Because the access token is not renewed and expiration is set to '30 days', it makes sense in this case that after 30 days the refresh token is invalidated. In my case, however, I set refresh token usage to 'One time'. With every new access token I also get a new refresh token (which should be valid for 30 days each in my opinion). After 30 days the newly received refresh token (which is created that same day) is invalidated within 1 hour, whereas I would expect that only the very first access token would be invalidated if it hadn't be used after 30 days. Other API's with oAuth I know all work that way. @Visma?
... View more
16-05-2024
15:19
Hi Sander, Thank you for your reply. I'm afraid that changing that setting doesn't solve the issue. We had the setting 'Refresh token usage' at 'Re use' a few months ago. In that case, the refresh token stays always the same and will expire after the amount of days set in 'the refresh token expiration is set to', which we experienced at that time. Changing it to 'One time' resulted in a new refresh token with each access token renewal. In my opinion these unique refresh tokens should be valid until used or when the expiration interval has passed. That is the behavior we see with other API's we connect with. Currently, a new refresh token is created/provided each time but the refresh token expires after the very first refresh token was created / user gave consent in oAuth flow. Is this a bug in Visma or am I missing something? Thank you! Mathijs
... View more
16-05-2024
13:26
Hi all, We encounter an issue with refresh tokens. Each time we get a new access token, a new refresh token is provided. This works correctly, as we see the refresh token being renewed each time. We use that new refresh token when getting the next access token. 30 days after the permission is granted by our end user, the newly generated refresh token (which was generated 1 hour ago and never used) returns 'Invalid grant' when getting a new access token. At first we thought it was an incident. But it persists month over month so we would like to know the cause and fix it. These are our 'Offline Access Configuration' settings': - Refresh token usage: One time - Refresh tokens per user: 5 - The refresh token expiration is set to '30 days' - But will expire if not used in [disabled] - Update Access Token Claims [enabled] Is there something wrong in our approach or settings? Do other devs experience the same issue? Thanks!
... View more
Activity Feed for Mathijsdb
- Posted Re: Getting access_token returns invalid_grant after 30 days, 'Refresh token usage' is set to 'One t on Forum in Developers Visma.net. 21-05-2024 11:30
- Posted Re: Getting access_token returns invalid_grant after 30 days, 'Refresh token usage' is set to 'One t on Forum in Developers Visma.net. 16-05-2024 15:19
- Posted Getting access_token returns invalid_grant after 30 days, 'Refresh token usage' is set to 'One time' on Forum in Developers Visma.net. 16-05-2024 13:26