Auto refresh Token is not working

Ask the Experts and Postman Tips
1

My question:I am Using Oauth 2.0 for my project , where Access token gets expired every 19 mins , I have to go and click on Get New Access Token Every time . Refresh Token is not working . can anybody please guide me to refresh Token

Details (like screenshots):

image
image1050Ă—451 41.9 KB

2

Do you have “Auto-refresh access token” toggled ON, like shown here?

image
image1062Ă—546 76.2 KB

3

image
image1103Ă—609 51.3 KB

I have turned it on , but still its not refreshing . Please help me on this .
I am using version 10.8.0

4

I’m having the same issue. This used to work until I updated Postman yesterday. Currently I’m on 10.10.5, not sure what version I was running before though

1 Like
5

I do not have the option of toggle Auto-Refresh Token button. It says refresh token is not present.

image
image1059Ă—549 40 KB

6

Hi amanjotsigh - we have exactly the same situation where the auto refresh token toggle button is greyed out.

Did you get any help / solution?

thanks

7

Hi @aerospace-engineer-2 Did you find a solution for this? I am facing the same issue.

8

Hi sorry, no solution so far. :frowning_face:

9

The oAuth provider needs to return a refresh token as well as the access token. If you request a token with Postman, or if you use “Manage Access Tokens” you should see both the access and refresh tokens. If it just has the access token the oAuth provider isnt returning the refresh token. Once a refresh token has been acquired the “Auto-refresh token” option will be enabled.

When using Microsoft Azure as an oAuth2.0 provider you need to use offline_access in the scope. This will need to be configured in your app registration too.

For other providers the scopes will be different. Review their documentation or contact their support.

image
image790Ă—847 47.6 KB

10

Same issue here. Recently upgraded to v10.12.8. Auto refresh enabled, but not working. Seems like the client_id is not passed in the request body.

11

hi @jetison We cannot get a refresh token to work either.

12

Doesn’t work for me either.
My provider doesn’t return a refresh token, I just hit the same URL again to get a new token.

I get why @Moodie007 says that the oAuth provider should provide a refresh token, but if they don’t, why can’t Postman just hit the same URL again for me?

It should refresh in the same way that it does when I click Get New Access Token.

Super annoying.

13

For Azure OAuth 2.0 client credentials flow, the Microsoft documentation states that

…refresh tokens will never be granted with this flow as client_id and client_secret (which would be required to obtain a refresh token) can be used to obtain an access token instead.

In this case the offline_access scope will not help and Postman should preferably just call the token endpoint to get a new access token instead.

14

All,
I discovered this after I realised our provider doesn’t provide an Access token. Is there any way to automate this request? Perhaps as a pre-request script?

15

Did you ever solve this? I am having same issue.

16

Hi,

I’ve never had any luck using this approach, I found a script on here years ago and have continued to use it, as its reliable.

I use the code below in the Collection Re-requests script to check if the token is still valid and if it’s not then it will renew the token automatically before making the actual request.

The authData variable contains the clientId:clientSecret base64 encoded

the script will store the access token (jwt) as an environment variable so it can be added to all requests that require it, or add it to the collection or folder-level authentication tab if you need it on all requests,

If your auth service is different to this one, you may need to tweak the request header or body for it to work.

const { has } = require('lodash');
const moment = require('moment');

const getJWT = {
  url: `${pm.environment.get('accessTokenUri')}`,
  method: 'POST',
  header: {
    'Content-Type': 'application/x-www-form-urlencoded',
    Authorization: `Basic ${pm.environment.get('authData')}`,
  },
  body: {
    mode: 'urlencoded',
    urlencoded: [
      { key: 'grant_type', value: 'client_credentials' },
      { key: 'scope', value: `${pm.environment.get('scope')}` },
    ],
  },
};

let getToken = true;

if (
  !has(pm.environment.toObject(), 'accessTokenExpiry') ||
  !has(pm.environment.toObject(), 'jwt') ||
  pm.environment.get('accessTokenExpiry') <= moment().valueOf()
) {
} else {
  getToken = false;
}

if (getToken) {
  pm.sendRequest(getJWT, (err, res) => {
    if (err === null) {
      pm.environment.set('jwt', `${res.json().access_token}`);

      var expiryDate = moment().add(res.json().expires_in, 's').valueOf();
      pm.environment.set('accessTokenExpiry', expiryDate);
    }
  });
}