# OAuth 2 Enhancements

**URL:** <https://discuss.konghq.com/t/oauth-2-enhancements/4415>\
**Category:** Questions\
**Created:** [September 12, 2019, 2:49pm UTC](https://discuss.konghq.com/t/oauth-2-enhancements/4415 "2019-09-12T14:49:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joe](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/joe/32/1327_2.png) [@Joe](https://discuss.konghq.com/u/Joe)\
**Post date:** [September 12, 2019, 2:49pm UTC](https://discuss.konghq.com/t/oauth-2-enhancements/4415/1 "2019-09-12T14:49:00Z")

</div>

We need to add an option to the OAuth plugin to allow for refresh tokens to not be deleted when a new one is issued, and to add an option to allow for multiple access tokens per refresh token (they’ll be revoked when the TTL expires, but shouldn’t be revoked when a new access token is granted).

My question is, what’s the best way to implement these enhancements with the new database layer changes in 1.x? Also, is there a path to get these enhancements into the official OAuth 2 plugin?

---

<div class="post-metadata">

**Author:** ![mike.roth](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/mike.roth/32/1348_2.png) [@mike.roth](https://discuss.konghq.com/u/mike.roth)\
**Post date:** [September 25, 2019, 7:30pm UTC](https://discuss.konghq.com/t/oauth-2-enhancements/4415/2 "2019-09-25T19:30:29Z")

</div>

@hbagdi can you or someone from the Kong team provide some insight here? This is a very important feature for us and I’m sure others in the Kong Community would benefit from this flexibility as well.

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [October 1, 2019, 4:07pm UTC](https://discuss.konghq.com/t/oauth-2-enhancements/4415/3 "2019-10-01T16:07:24Z")

</div>

> [@Joe](#):
>
> My question is, what’s the best way to implement these enhancements with the new database layer changes in 1.x? Also, is there a path to get these enhancements into the official OAuth 2 plugin?

Please take a look at the following PR as a reference to create TTL based tokens: [feat(key-auth) support auto-expiring keys through dao ttl by eskerda · Pull Request #4984 · Kong/kong · GitHub](https://github.com/Kong/kong/pull/4984)

> [@Joe](#):
>
> Also, is there a path to get these enhancements into the official OAuth 2 plugin?

We have no plans of adding this support from our side but a community led PR can sure help here.