Refresh Token

// Request refresh token during initial authorization
const tokenResponse = await fetch('https://oauth.provider.com/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    grant_type: 'authorization_code',
    code: authorizationCode,
    client_id: 'your_client_id',
    client_secret: 'your_client_secret',
    redirect_uri: 'https://yourapp.com/callback'
  })
});

const { access_token, refresh_token, expires_in } = await tokenResponse.json();

// Store refresh token securely
secureStorage.set('refresh_token', refresh_token);

// Use refresh token to get new access token
async function refreshAccessToken() {
  const response = await fetch('https://oauth.provider.com/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'refresh_token',
      refresh_token: secureStorage.get('refresh_token'),
      client_id: 'your_client_id',
      client_secret: 'your_client_secret'
    })
  });

  const tokens = await response.json();

  // Update stored tokens (some providers rotate refresh tokens)
  if (tokens.refresh_token) {
    secureStorage.set('refresh_token', tokens.refresh_token);
  }

  return tokens.access_token;
}

// Automatic token refresh on 401
async function apiCall(url) {
  let response = await fetch(url, {
    headers: { 'Authorization': `Bearer ${currentAccessToken}` }
  });

  if (response.status === 401) {
    currentAccessToken = await refreshAccessToken();
    response = await fetch(url, {
      headers: { 'Authorization': `Bearer ${currentAccessToken}` }
    });
  }

  return response;
}