# Refresh Token in oauth2 plugin

**URL:** <https://discuss.konghq.com/t/refresh-token-in-oauth2-plugin/9127>\
**Category:** Questions\
**Created:** [October 4, 2021, 2:10pm UTC](https://discuss.konghq.com/t/refresh-token-in-oauth2-plugin/9127 "2021-10-04T14:10:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ritika](https://avatars.discourse-cdn.com/v4/letter/r/67e7ee/32.png) [@ritika](https://discuss.konghq.com/u/ritika)\
**Post date:** [October 4, 2021, 2:10pm UTC](https://discuss.konghq.com/t/refresh-token-in-oauth2-plugin/9127/1 "2021-10-04T14:10:26Z")

</div>

Hello,

I am a new user of Kong (OSS) and currently trying to create a customer for oauth2 plugin.  
Could anyone help me understand that why am I not receving a refresh token along with access token.

**oauth2 Configuration as follows:**

{“data”:[{“name”:“oauth2”,“route”:null,“consumer”:null,“tags”:null,“id”:“91d99855-08ad-4823-addd-d75f1b1bf7ce”,“enabled”:true,“service”:{“id”:“764a539f-5606-4cc7-bffa-7b54ca4247ed”},“config”:{“anonymous”:null,“hide\_credentials”:false,“accept\_http\_if\_already\_terminated”:false,“scopes”:[“email”],“provision\_key”:“PROVISION\_KEY”,“reuse\_refresh\_token”:false,“enable\_implicit\_grant”:false,“enable\_client\_credentials”:true,“enable\_password\_grant”:false,“enable\_authorization\_code”:false,“token\_expiration”:7200,“refresh\_token\_ttl”:1209600,“global\_credentials”:false,“mandatory\_scope”:true,“pkce”:“lax”,“auth\_header\_name”:“authorization”},“created\_at”:1633072591,“protocols”:[“grpc”,“grpcs”,“http”,“https”]}],“next”:null}

**Command used to retreive the tokens**  
curl -X POST --url [https://localhost:8443/api/v1/process-start/oauth2/token](https://localhost:8443/api/v1/process-start/oauth2/token)   
–data “client\_id=CLIENT\_ID” \  
–data “client\_secret=CLIENT\_SECRET”   
–data “grant\_type=client\_credentials”   
–data “scope=email”   
–data “provision\_key=PROVISION\_KEY” --insecure

**Response:**  
{“token\_type”:“bearer”,“access\_token”:“ACCESS\_TOKEN”,“expires\_in”:7200}

Please excuse me for the fomatting and thank you in advance for your time.

Best regards,  
Ritika

---

<div class="post-metadata">

**Author:** ![fomm](https://avatars.discourse-cdn.com/v4/letter/f/ea666f/32.png) [@fomm](https://discuss.konghq.com/u/fomm)\
**Post date:** [October 4, 2021, 2:19pm UTC](https://discuss.konghq.com/t/refresh-token-in-oauth2-plugin/9127/2 "2021-10-04T14:19:11Z")

</div>

`client_credential` grant does not returns refresh token.

If you need refresh token, try password or authorization code flow instead.

---

<div class="post-metadata">

**Author:** ![ritika](https://avatars.discourse-cdn.com/v4/letter/r/67e7ee/32.png) [@ritika](https://discuss.konghq.com/u/ritika)\
**Post date:** [October 4, 2021, 3:07pm UTC](https://discuss.konghq.com/t/refresh-token-in-oauth2-plugin/9127/3 "2021-10-04T15:07:32Z")

</div>

Hello,  
Thank you for your reply. Could you please tell me is it possibe to change the exsiting oauth2 configuration or should I delete everything and start again?  
Thank you.  
Best regards,  
Ritika

---

<div class="post-metadata">

**Author:** ![fomm](https://avatars.discourse-cdn.com/v4/letter/f/ea666f/32.png) [@fomm](https://discuss.konghq.com/u/fomm)\
**Post date:** [October 4, 2021, 10:00pm UTC](https://discuss.konghq.com/t/refresh-token-in-oauth2-plugin/9127/4 "2021-10-04T22:00:51Z")

</div>

You just need to enable password or authorization code grant of your existing plugin.

---

<div class="post-metadata">

**Author:** ![ritika](https://avatars.discourse-cdn.com/v4/letter/r/67e7ee/32.png) [@ritika](https://discuss.konghq.com/u/ritika)\
**Post date:** [October 5, 2021, 9:50am UTC](https://discuss.konghq.com/t/refresh-token-in-oauth2-plugin/9127/5 "2021-10-05T09:50:59Z")

</div>

Hello,  
Thanks for your reply. I will try the changes. Also, in case of client credentials, once the access token expires what can be done for the consumer so that he gets another access token? I can only think that “token\_expiration” parameter must be set to 0 so that the access token never expires. Is there any other way as well?

Thank you in advance  
Best regards,  
Ritika

---

<div class="post-metadata">

**Author:** ![fomm](https://avatars.discourse-cdn.com/v4/letter/f/ea666f/32.png) [@fomm](https://discuss.konghq.com/u/fomm)\
**Post date:** [October 5, 2021, 10:02am UTC](https://discuss.konghq.com/t/refresh-token-in-oauth2-plugin/9127/6 "2021-10-05T10:02:33Z")

</div>

Once it expired, you should request a new access\_token.

Client\_credential is meant to be used as machine to machine. Getting an access\_token should be automated.

---

<div class="post-metadata">

**Author:** ![ritika](https://avatars.discourse-cdn.com/v4/letter/r/67e7ee/32.png) [@ritika](https://discuss.konghq.com/u/ritika)\
**Post date:** [October 6, 2021, 7:36am UTC](https://discuss.konghq.com/t/refresh-token-in-oauth2-plugin/9127/7 "2021-10-06T07:36:57Z")

</div>

Hello,  
Thank you for your answer. Earlier like you said client\_credentials does not return refresh token, so how can an access token be generated without it. Because according to the docs, the command needs a previously returned refresh token.

Also how can the process of getting an access\_token be automated? Is there a plugin for Kong?

Thanks in advance,  
Ritika