[GH-ISSUE #113] New Refresh Token #68

New issue

Closed

opened 2026-02-27 19:25:53 +03:00 by kerem · 5 comments

kerem commented

2026-02-27 19:25:53 +03:00

Owner

Originally created by @Hickmeister on GitHub (Jan 2, 2018).
Original GitHub issue: https://github.com/jwilsson/spotify-web-api-php/issues/113

Is there a way to get a new Refresh token after using a previous Refresh token to gain a new Access token?
Because on the Spotify docs it says under the authorization code flow page

refresh_token | string | : "A token that can be sent to the Spotify Accounts service in place of an authorization code. (When the access code expires, send a POST request to the Accounts service /api/token endpoint, but use this code in place of an authorization code. A new access token will be returned. A new refresh token might be returned too.)"

So would a new refresh token be sent aswell?

Originally created by @Hickmeister on GitHub (Jan 2, 2018). Original GitHub issue: https://github.com/jwilsson/spotify-web-api-php/issues/113 Is there a way to get a new Refresh token after using a previous Refresh token to gain a new Access token? Because on the Spotify docs it says under the authorization code flow page **refresh_token | string |** : "A token that can be sent to the Spotify Accounts service in place of an authorization code. (When the access code expires, send a POST request to the Accounts service /api/token endpoint, but use this code in place of an authorization code. A new access token will be returned. **A new refresh token might be returned too**.)" So would a new refresh token be sent aswell?

kerem

2026-02-27 19:25:53 +03:00

closed this issue
added the
bug

good first issue
labels

kerem commented

2026-02-27 19:25:53 +03:00

Author

Owner

@jwilsson commented on GitHub (Jan 2, 2018):

Hi!
It seems we missed that part in the Session::refreshAccessToken() method, so it won't set a new refresh token, if one exists in the response.

Would you be interested in submitting a PR and setting a new refresh token if one is included?

@jwilsson commented on GitHub (Jan 2, 2018): Hi! It seems we missed that part in the `Session::refreshAccessToken()` method, so it won't set a new refresh token, if one exists in the response. Would you be interested in submitting a PR and setting a new refresh token if one is included?

kerem commented

2026-02-27 19:25:53 +03:00

Author

Owner

@andersborgabiro commented on GitHub (Jan 2, 2018):

Isn't the whole point that a refresh token is a constant? What would be the gain if it changed?

@andersborgabiro commented on GitHub (Jan 2, 2018): Isn't the whole point that a refresh token is a constant? What would be the gain if it changed?

kerem commented

2026-02-27 19:25:53 +03:00

Author

Owner

@jwilsson commented on GitHub (Jan 2, 2018):

@andersborgabiro I don't know why a new refresh token would be included (unless it's been revoked for some reason) but I think the server is allowed to decide if it wants to generate a new one or not. So I definitely think we need to support that case.

@jwilsson commented on GitHub (Jan 2, 2018): @andersborgabiro I don't know why a new refresh token would be included (unless it's been revoked for some reason) but I think the server is allowed to decide if it wants to generate a new one or not. So I definitely think we need to support that case.

kerem commented

2026-02-27 19:25:53 +03:00

Author

Owner

@andersborgabiro commented on GitHub (Jan 2, 2018):

Understood and agreed.

@andersborgabiro commented on GitHub (Jan 2, 2018): Understood and agreed.

kerem commented

2026-02-27 19:25:53 +03:00

Author

Owner

@jwilsson commented on GitHub (Feb 2, 2018):