title: OAuth Client Credential Flow - Refresh Tokens
body: <p><strong>The Scenario</strong></p>
  <p>I've recently built an API, and have protected its resources using <code>OAuth</code> Bearer Access Tokens.</p>
  <p>I've used the <code>Client_Credentials</code> Flow, as it will be accessed by clients as opposed to users.</p>
  <p>Here's the thing, when a client has successfully provided the <code>client_id</code> and the <code>client_secret</code> they receive a response like the following :-</p>
  <pre><code>{
    &quot;access_token&quot;: &quot;&lt;Access Token&gt;&quot;,
    &quot;token_type&quot;: &quot;bearer&quot;,
    &quot;expires_in&quot;: 1199,
    &quot;refresh_token&quot;: &quot;&lt;Refresh Token&gt;&quot;
  }
  </code></pre>
  <p><strong>Refresh Tokens.</strong></p>
  <p>Not knowing much about refresh tokens, i immediately assumed that a client would be able to provide the OAuth Server the <code>refresh_token</code> to retrieve a fresh <code>Access_Token</code>.</p>
  <p>This is 'kind of' correct.</p>
  <p>In order to use the <code>refresh_token</code> the client still needs to pass the <code>client_id</code> and <code>client_secret</code> along with the <code>refresh_token</code> to get a new access token.</p>
  <p>The <code>grant_type</code> also needs to be changed to <code>refresh_token</code>.</p>
  <p>Where is the benefit of a refresh_token using this flow? If I need to pass the client_id and client_secret each time, surely you would just avoid using a refresh token altogether?</p>