request any scope not originally granted by the resource owner..

Condition: when including scope in a refresh request

The requested scope MUST NOT include any scope not originally granted by the resource owner.

set grant_type to "refresh_token"..

Condition: when making a refresh-token grant request

Value MUST be set to "refresh_token".

authenticate with the authorization server..

Condition: if the client is confidential, was issued client credentials, or has other authentication requirements

the client MUST authenticate with the authorization server as described in Section 3.2.1.

discard the old refresh token and replace it with the new refresh token..

Condition: if a new refresh token is issued

the client MUST discard the old refresh token and replace it with the new refresh token.

include the refresh_token parameter in the refresh request..

Condition: when making a refresh-token grant request

refresh_token REQUIRED. The refresh token issued to the client.

include the grant_type parameter in the refresh request..

Condition: when making a refresh-token grant request

grant_type REQUIRED.

include the scope parameter in the refresh request..

Condition: when making a refresh-token grant request

scope OPTIONAL.

maintain the binding between a refresh token and the client to which it was issued..

Condition: when issuing and processing refresh tokens

The authorization server MUST maintain the binding between a refresh token and the client to whom it was issued.

verify the binding between the refresh token and client identity..

Condition: whenever the client identity can be authenticated

The authorization server MUST verify the binding between the refresh token and client identity whenever the client identity can be authenticated.

ensure unauthorized parties cannot generate, modify, or guess values that produce valid refresh tokens..

Condition: when designing and issuing refresh tokens

The authorization server MUST ensure that refresh tokens cannot be generated, modified, or guessed to produce valid refresh tokens by unauthorized parties.

include Cache-Control with value "no-store" and Pragma with value "no-cache"..

Condition: in any response containing a refresh token or other sensitive information

The authorization server MUST include the HTTP "Cache-Control" response header field with a value of "no-store" ... as well as the "Pragma" response header field with a value of "no-cache".

require client authentication..

Condition: for confidential clients and clients issued credentials or assigned other authentication requirements

The authorization server MUST: require client authentication for confidential clients or for any client that was issued client credentials.

authenticate the client and ensure the refresh token was issued to that client..

Condition: if client authentication is included

The authorization server MUST: authenticate the client if client authentication is included and ensure that the refresh token was issued to the authenticated client.

validate the refresh token..

Condition: when processing a refresh request

The authorization server MUST: validate the refresh token.

keep the new refresh token's scope identical to the scope of the refresh token presented by the client..

Condition: if a new refresh token is issued

the refresh token scope MUST be identical to that of the refresh token included by the client in the request.

determine whether to issue refresh tokens to a particular client based on a risk assessment..

Condition: before issuing refresh tokens

Authorization servers MUST determine, based on a risk assessment, whether to issue refresh tokens to a certain client.

bind issued refresh tokens to the scope and resource servers consented to by the resource owner..

Condition: if refresh tokens are issued

those refresh tokens MUST be bound to the scope and resource servers as consented by the resource owner.

use sender-constrained refresh tokens or refresh token rotation to detect replay for public clients..

Condition: when issuing refresh tokens to public clients

Authorization servers MUST utilize one of these methods to detect refresh token replay by malicious actors for public clients.

ensure the integrity of a refresh token value that encodes its associated grant..

Condition: if grant information is encoded into the refresh token itself

Authorization servers MUST ensure the integrity of the refresh token value in this case.

deploy other means to detect refresh token abuse..

Condition: when client authentication is not possible

the authorization server SHOULD deploy other means to detect refresh token abuse.

issue refresh tokens to web application clients and native application clients..

Authorization servers MAY issue refresh tokens to web application clients and native application clients.

issue a new refresh token..

Condition: when issuing an access token in response to a valid refresh request

The authorization server MAY issue a new refresh token.

revoke the old refresh token..

Condition: after issuing a new refresh token to the client

The authorization server MAY revoke the old refresh token after issuing a new refresh token.

automatically revoke refresh tokens following a security event..

Condition: in case of a security event such as a password change or logout

Authorization servers MAY revoke refresh tokens automatically in case of a security event.

include the refresh_token parameter in a successful token response..

Condition: when constructing a successful token response

refresh_token OPTIONAL.

keep refresh tokens confidential in transit and storage and share them only between the authorization server and the client to which they were issued..

Condition: when handling refresh tokens

Refresh tokens MUST be kept confidential in transit and storage, and shared only among the authorization server and the client.

transmit refresh tokens only using TLS with server authentication..

Condition: when transmitting refresh tokens

Refresh tokens MUST only be transmitted using TLS as described in Section 1.6 with server authentication.

expire after a period of client inactivity..

Condition: if it has not been used to obtain fresh access tokens for some time

Refresh tokens SHOULD expire if the client has been inactive for some time.