In this video discuss section 1.5 "Refresh Token" of the OAuth 2.0 Specification (IETF RFC 6749).
https://tools.ietf.org/html/rfc6749#s...
I discuss how refresh tokens used to obtain new access tokens when an access token has expired. Refresh tokens are only used with an Authorization server, they are never sent to a Resource server. Also, the "Implicit" grant type cannot get a refresh token because of the inherent insecurity.
This video is part of a series:
• Understanding the OAuth 2.0 Directly ...