The city’s confidential client receives an optional refresh token after a successful authorization-code grant. How does refresh relate to the official three-legged sequence?
Select an answer to reveal the explanation.
Short Explanation
Refresh is the “come back tomorrow with this stub” after you already finished the full check-in. It sits after the four official steps; it does not replace them, and it is not client-credentials.
Full Explanation
A refresh token is an optional later hop after the official three-legged sequence has already completed: authorize → code → token → resource. Refresh obtains a new access token without sending the resident through consent again; it supplements the city’s confidential-client happy path rather than replacing authorize, code receipt, or the initial token exchange.
Refresh alone is not the DEVCOR 2.5 happy path and cannot stand in for the full authorization-code grant. Refresh is not identical to client-credentials—it still depends on a prior user-approved grant and is not a fresh two-legged machine login without consent. Refresh validity is not gated on PKCE appearing as a numbered exam bullet; PKCE and refresh are separate construction concerns. Revoke or rotate refresh tokens when a municipal client is decommissioned or suspected compromised, because refresh continues access without fresh consent. Document whether each civic AS issues refresh_token at all so developers do not assume it always appears.
Exam caveat: learn the four official steps first; treat refresh as post-grant session continuity only when the authorization server actually issued refresh_token. Operational check: complete one full code grant, call a resource, let access_token expire, POST grant_type=refresh_token with the refresh token, and confirm a new access token works without another authorize redirect.