Use of refresh_token

[CONSULitAS]

Hi,

you state

I've no idea what the refresh_token is for. Once the access_token expires, you can simply re-authenticate and gain a new one.

in your readme.md.

Perhaps this helps:

https://www.oauth.com/oauth2-servers/access-tokens/refreshing-access-tokens/

Using

POST /oauth/token HTTP/1.1
Host: authorization-server.com
 
grant_type=refresh_token
&refresh_token=xxxxxxxxxxx
&client_id=xxxxxxxxxx
&client_secret=xxxxxxxxxx

you get a new token without login credentials:

The response to the refresh token grant is the same as when issuing an access token. You can optionally issue a new refresh token in the response, or if you don’t include a new refresh token, the client assumes the current refresh token will continue to be valid.

Greetings