OAuth 2.0 Refresh Tokens

A brief 3-minute overview of how refresh tokens work within an OAuth 2.0 authentication flow.

[govindrai]

holy smokes man i kept skipping out on your video because I thought it was too short to be able to explain what I thought was such a complicated topic, so I ended up watching a shit load of other videos that were 10 to 20 times longer but couldn't convey key concepts that you conveyed in 2 mins.This was an awesome video because it cleared up for me the concept that the client doesn't send the refresh token until they get an invalid token response and that the server actually needs to have an endpoint where is the client can go and refresh their token. spent three days on this, well spent, but thank you so much

[MethodMan]

Thanks for the video, simple and concise without any boring additional info

[sming]

Simple and clear! Great explanation with example, thank you so much! ☺☺

[aamadeo]

What if I get another access token without the refresh token. I thought the refresh token was meant to be used without the credentials. Why couldn't I just get another AccessToken without the refresh token, just with the credentials, like the first time.?

[rojeenamaharjan]

Such a clear explanation !!! Thank you

[zohar]

thanks for the video, I watched few of your videos and you explain the concepts very well, that's exactly what I needed, thanks!

[DubstepRS]

Should I store the refresh token in the database? If so does it need to be encrypted?

[suhasgaminglive]

Can you make video with detail code implementation for this

[shahamitsynygy]

Thanks for the video. a quick question - What is the advantage over having an refresh token over the client requesting new access tokens every time the token expires? If its about saving us from the two step process of generating an access token then are refresh tokens only applicable for auth code grant type and not client credentials?