Access Tokens, Refresh Tokens, and Scopes

An integration may need to keep working long after its initial access token expires. Suppose a customer connects ReadShelf to a bookstore and starts importing a large collection of reading lists. Fifteen minutes later, the access token expires. Asking the customer to sign in repeatedly would interrupt the job. Making the same token valid for months would leave a copied credential usable for much longer.

Access tokens and refresh tokens separate ordinary API access from the ability to obtain replacement credentials. Scopes describe the operations the authorization grant permits.

This chapter explains how those pieces work together, including renewal, rotation, concurrent requests, permission changes, and disconnecting an integration.

The examples use ReadShelf's confidential backend and a fictional bookstore API over HTTPS. The customer has already authorized reading-list access. The bookstore issues bearer access tokens and rotating refresh tokens, while ReadShelf stores both on its backend. Paths, scope names, and lifetime policies are application choices.