OAuth Access & refresh token questions

[tommy (Tommy Gaessler)]

Hey @hunter.steele2,

@hunter.steele2

I have Webhooks/Event subscription enabled. What happens if the AccessToken expires but my RefreshToken is valid, will I still receive Webhooks? I ask this because I only refresh my access token on demand when calling the API.

Yes, the webhooks will still send! Refreshing your token on demand is the suggested flow so you are good!

@hunter.steele2

While testing, I have been noticing that my refresh token suddenly stops working. I suspect this is happening when the same user logs in on the browser on different machines… So my question is, under what circumstances is the refresh token revoked, if never, then why do I suddenly start getting 401’s when using my refresh token?

Hey @hunter.steele2,

Yes, if a user logins in on a different device, the OAuth flow basically restarts, invalidating the current OAuth access and refresh tokens you have stored. You will need to get the access_token again upon new authorization and update your save tokens with the new tokens.

Thanks,
Tommy