The city’s confidential client receives an optional refresh token after a successful authorization-code grant. How does refresh relate to the official three-legged sequence?
Select an answer to reveal the explanation.
Short Explanation
Refresh is the “come back tomorrow with this stub” after you already finished the full check-in. It sits after the four official steps; it does not replace them, and it is not client-credentials.
Full Explanation
A refresh token lets a confidential client obtain a new access token without sending the user through authorize again, but only after a successful code grant. Refresh is not a substitute for authorize → code → token → resource, nor is it client-credentials. PKCE may enhance the flow but is not a numbered DEVCOR extra task required as the sole correct 2.5 answer.