# Refresh Token change?

**URL:** <https://devforum.okta.com/t/refresh-token-change/902>\
**Category:** OAuth/OIDC\
**Created:** [December 14, 2017, 8:40pm UTC](https://devforum.okta.com/t/refresh-token-change/902 "2017-12-14T20:40:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nacasuy](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/nacasuy/32/159_2.png) [@nacasuy](https://devforum.okta.com/u/nacasuy)\
**Post date:** [December 14, 2017, 8:40pm UTC](https://devforum.okta.com/t/refresh-token-change/902/1 "2017-12-14T20:40:56Z")

</div>

Hi I may be understanding wrong the purpose of a refresh token but If I configure in okta that refresh token will never expire and use the endpoint to get a refresh token should I receive always the same refresh token?

I am using v1/token endpoint to get a refresh token but this seems to be returning different values in different environments…I am confused about this behavior.

If the refresh\_token can change, what’s the proper way of getting a refresh\_token

Thanks

---

<div class="post-metadata">

**Author:** ![tom](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/tom/32/24_2.png) [@tom](https://devforum.okta.com/u/tom)\
**Post date:** [December 15, 2017, 9:54pm UTC](https://devforum.okta.com/t/refresh-token-change/902/2 "2017-12-15T21:54:24Z")

</div>

What are you passing to the `/v1/tokens` endpoint?

If it is something like a new code for a user, or resource owner’s username and password, you will get a different refresh token. If you are using the refresh grant, then you should be getting back the same token. Does that make sense?

---

<div class="post-metadata">

**Author:** ![nacasuy](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/nacasuy/32/159_2.png) [@nacasuy](https://devforum.okta.com/u/nacasuy)\
**Post date:** [December 20, 2017, 4:48pm UTC](https://devforum.okta.com/t/refresh-token-change/902/3 "2017-12-20T16:48:38Z")

</div>

So the question should be how do I get the refresh token using /oauth2/v1/token endpoint? I did not find an example or indications on how to do that

---

<div class="post-metadata">

**Author:** ![nate.barbettini](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/nate.barbettini/32/385_2.png) [@nate.barbettini](https://devforum.okta.com/u/nate.barbettini)\
**Post date:** [December 20, 2017, 8:53pm UTC](https://devforum.okta.com/t/refresh-token-change/902/4 "2017-12-20T20:53:27Z")

</div>

You need to request the `offline_access` scope during the initial OAuth flow. If you do that, you’ll get a refresh token (in addition to access and ID tokens). See here: [How to get a refresh token](https://developer.okta.com/authentication-guide/tokens/refreshing-tokens#how-to-get-a-refresh-token)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 12, 2024, 8:11pm UTC](https://devforum.okta.com/t/refresh-token-change/902/5 "2024-01-12T20:11:27Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.