Refreshing Tokens
There are two ways to refresh tokens:
- Using a Basic Auth header to send the
client_idandclient_secret - Use the
client_idandclient_secretas part of the x-www-form-urlencoded body
Use the Basic Auth header to prevent passing confidential information as part of a query string that could be logged. For example a web server hosting an Nginx load balancer could log the request with the full query string.
You can refresh an access token by sending a POST request to the following URL:
Upon a successful refresh, the previous access & refresh token pair will be invalidated and you will receive a new pair of tokens with new expiration times. The expiration time for access tokens is 1 hour and 1 year for refresh tokens from the time of grant.
Because this endpoint requires the submission of the client_secret, user's devices should never have or use the secret to make refresh requests directly to Restream. Instead, their device should make a request to a proxy endpoint provided by the client web application. The client should then forward the request with the appropriate credentials to the refresh token route listed above and relay the results back to the user.