Refresh Token Grant
The refresh token grant (grant_type=refresh_token) lets a client obtain a new access token (and sometimes a rotated refresh token) without sending the user through login and consent again. It applies only after an interactive grant — authorization code or CIBA — already issued a refresh token.
Refresh is not a separate toggle in the Console; it is part of the token response from user-delegated flows.
How it works
- The client previously completed an authorization code or CIBA flow and stored the refresh token from the token response.
- When the access token expires (or is about to), the client sends
POSTto the token endpoint withgrant_type=refresh_token,refresh_token, andclient_id. - Confidential clients also send
client_secret. Public clients refresh without a secret (the app must have been created as a public client). - Descope validates the refresh token and consent record. If consent was revoked or expired, refresh fails and the user must authorize again.
- Descope returns a new access token. Refresh does not re-prompt for scopes the user already granted unless consent expired.
Audit trail
Inbound App token refresh is not recorded in the audit trail. Plan session and consent expiry accordingly.
Consent expiry
If the user revokes consent or the consent period expires, refresh fails once the current access token expires. Keep session expiry aligned with your risk model.
Implement
See Using Inbound Apps → Refreshing Access Tokens for confidential and public client examples.