What are we supposed to do with the access_token?

Hi, have you ever tried to validate the refresh_token? I tried but always got the error of "unsupported_grant_type". Does it apply to you too?

The Post Body I have is:

client_id: "App ID" // same as authorization

client_secret: "App Token" // same as authorization

grant_type: "refresh_token"

code: "refresh_token received from authorization"

Try replacing code with refresh_token ... as per the documentation
The validation server returns a TokenResponse object on a successful validation. When using this endpoint for authorizing the user, use the following parameters:

client_id

client_secret

grant_type

code

redirect_uri

client_id

client_secret

grant_type

refresh_token

Thank you very much for your reply!

There was a typo in my last response and I did use key-value pair of refresh_token: "refresh_token received from authorization". Thank you for the catch! I finally found that the problem was I didn't use "x-www-form-urlencoded" as the body format. After I fixed that, the request to validate refresh token is successful.

I have the same question as yours. Access_token expires in 3600 seconds(1 hour) and it seems to be useless. Let's see whether there will be any Apple staff can answer this question...

Thank you @sudhaker19 for the reply.

If access_token is useless now, may I know what the use for refresh_token is? If I understand the authorization flow correctly, after our server validates the auth code with Apple, the authorization for this one user is done. Why do we need to store the refresh_token as shown in the apple documentation "The refresh token used to regenerate new access tokens. Store this token securely on your server."? Is the refresh_token valid for each user, or each server?

Olá, como você conseguiu chegar a retornar o access-token? faz 15 dias que tento implementar o login com a apple em python, mas ele estagnei nesse erro: Error retrieving access token: b'{"error":"invalid_grant","error_description":"The code has expired or has been revoked."}'. Alguém sabe o que fazer?

How to get access token on second time using authcode?