What are we supposed to do with the access_token?

Hi, have you ever tried to validate the refresh_token? I tried but always got the error of "unsupported_grant_type". Does it apply to you too?

The Post Body I have is:

client_id: "App ID" // same as authorization

client_secret: "App Token" // same as authorization

grant_type: "refresh_token"

code: "refresh_token received from authorization"

Try replacing code with refresh_token ... as per the documentation
The validation server returns a TokenResponse object on a successful validation. When using this endpoint for authorizing the user, use the following parameters:

client_id

client_secret

grant_type

code

redirect_uri

client_id

client_secret

grant_type

refresh_token

Thank you very much for your reply!

There was a typo in my last response and I did use key-value pair of refresh_token: "refresh_token received from authorization". Thank you for the catch! I finally found that the problem was I didn't use "x-www-form-urlencoded" as the body format. After I fixed that, the request to validate refresh token is successful.

I have the same question as yours. Access_token expires in 3600 seconds(1 hour) and it seems to be useless. Let's see whether there will be any Apple staff can answer this question...

Hi concept47and angelatestapple

Currently, the access token only indicates a successful refresh token validation. There are currently no endpoints where it can be used and it is reserved for future use. So, it can be ignored for now.

Thank you @sudhaker19 for the reply.

If access_token is useless now, may I know what the use for refresh_token is? If I understand the authorization flow correctly, after our server validates the auth code with Apple, the authorization for this one user is done. Why do we need to store the refresh_token as shown in the apple documentation "The refresh token used to regenerate new access tokens. Store this token securely on your server."? Is the refresh_token valid for each user, or each server?

Olá, como você conseguiu chegar a retornar o access-token? faz 15 dias que tento implementar o login com a apple em python, mas ele estagnei nesse erro: Error retrieving access token: b'{"error":"invalid_grant","error_description":"The code has expired or has been revoked."}'. Alguém sabe o que fazer?

How to get access token on second time using authcode?