# How to request a refresh\_token? **URL:** \ **Category:** General Discussion\ **Created:** [February 26, 2021, 8:44am UTC](https://forum.solidproject.org/t/how-to-request-a-refresh-token/4025 "2021-02-26T08:44:18Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![hochstenbach](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/hochstenbach/32/2308_2.png) [@hochstenbach](https://forum.solidproject.org/u/hochstenbach)\ **Post date:** [February 26, 2021, 8:44am UTC](https://forum.solidproject.org/t/how-to-request-a-refresh-token/4025/1 "2021-02-26T08:44:18Z")
I’m writing my own Solid authentication implementation in Perl and got it all working. But I don’t seem to be able to request refresh\_tokens. I’m using the [Solid OIDC Primer](https://solid.github.io/authentication-panel/solid-oidc-primer/) as guideline to build an implementation. There is no mention of how refresh\_tokens should work. But, from information I found on the web I need to send a POST request to the OP token\_endpoint: ``` POST {OP_TOKEN_ENDPOINT} Content-Type: application/x-www-form-urlencoded grant_type=refresh_token& refresh_token={THE_REFRESH_TOKEN_FOUND_IN_THE_AUTH_RESPONSE}& client_id={THE_CLIENT_ID_OF_RP} ``` But all I get are Internal Server errors at the community server and inrupt server. I’ve tried adding DPoP headers, Authentication headers, any combination of headers with the same responses from the server. Any insight what is needed is very much appreciated! ---
**Author:** ![Vincent](https://avatars.discourse-cdn.com/v4/letter/v/e9bcb4/32.png) [@Vincent](https://forum.solidproject.org/u/Vincent)\ **Post date:** [February 26, 2021, 9:54am UTC](https://forum.solidproject.org/t/how-to-request-a-refresh-token/4025/2 "2021-02-26T09:54:54Z")
Hi @hochstenbach, this is outside my area of expertise, but could it be that you’re running into [OAuth refresh grant returns 500 internal server error · Issue #1533 · solid/node-solid-server · GitHub](https://github.com/solid/node-solid-server/issues/1533)? Does it work against [pod.inrupt.com](http://pod.inrupt.com) (which runs different server software)? ---
**Author:** ![hochstenbach](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/hochstenbach/32/2308_2.png) [@hochstenbach](https://forum.solidproject.org/u/hochstenbach)\ **Post date:** [February 26, 2021, 11:24am UTC](https://forum.solidproject.org/t/how-to-request-a-refresh-token/4025/3 "2021-02-26T11:24:32Z")
Thanks Vincent, indeed I get the same 500 Internal Error respons at the [inrupt.net](http://inrupt.net) server. It is as mentioned the issue #1533 where refresh\_tokens are not yet implemented for Node OIDC. ---
**Author:** ![crspybits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/crspybits/32/2857_2.png) [@crspybits](https://forum.solidproject.org/u/crspybits)\ **Post date:** [July 22, 2021, 3:01am UTC](https://forum.solidproject.org/t/how-to-request-a-refresh-token/4025/4 "2021-07-22T03:01:04Z")
Any progress on this? Refresh tokens are also important to my possible use case. Without them I doubt I’ll be able to proceed. ---
**Author:** ![jeffz](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/jeffz/32/600_2.png) [@jeffz](https://forum.solidproject.org/u/jeffz)\ **Post date:** [July 22, 2021, 3:19am UTC](https://forum.solidproject.org/t/how-to-request-a-refresh-token/4025/5 "2021-07-22T03:19:14Z")
[@inrupt/generate-oidc-token](https://github.com/inrupt/generate-oidc-token) will let you open a browser window to your identity provider, sign-in, and then send a token back to your command-line. It can then be used as proof of authentication anyplace you are authorized. It works with [inrupt.com](http://inrupt.com) (ESS), and with all up-to-date versions of NSS (e.g. [solidcommunity.net](http://solidcommunity.net)). The ESS token expires after **30 minutes** so for many cases you might want to login to NSS and authorize your NSS webid to access your ESS data. Additionally, on NSS servers, you can login outside a browser using username/password and get back a token. [Solid-Node-Client](https://github.com/solid/solid-node-client) supports both ways of getting a token from nodejs scripts. There are libraries to get Solid tokens written in Perl, Rust, Python, and Kotlin listed [here](https://solidproject.org/developers/tools/) though I haven’t personally tried any of them. ---
**Author:** ![vkraus](https://avatars.discourse-cdn.com/v4/letter/v/c5a1d2/32.png) [@vkraus](https://forum.solidproject.org/u/vkraus)\ **Post date:** [July 22, 2021, 8:03am UTC](https://forum.solidproject.org/t/how-to-request-a-refresh-token/4025/7 "2021-07-22T08:03:10Z")
Hello, I am doing the same work as you do, in guile. This is an unfortunate error of the server, but I think it should reject your request anyway (don’t take it personally!) For Solid, DPoP ([draft-ietf-oauth-dpop-03](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop-03#section-5)) applies and gives you a more precise description of the access token request. If you want to request an access token, you need to present a DPoP proof to the token endpoint, at least so that the server knows which key it should bind the access token to. If the refresh token was not bound to your key, then the server has no way to know your key. If the refresh token was bound to your key when you got it, the server needs to check that you still own this key. By the Solid primer, the access token must be DPoP-bound, so you must send your key somehow. I get it that the “Token Instantiation” section [SOLID-OIDC](https://solid.github.io/authentication-panel/solid-oidc/#tokens) of the primer does not require public clients to have a key to make DPoP proofs. I think this is simply an error. ---
**Author:** ![Vincent](https://avatars.discourse-cdn.com/v4/letter/v/e9bcb4/32.png) [@Vincent](https://forum.solidproject.org/u/Vincent)\ **Post date:** [July 26, 2021, 8:31am UTC](https://forum.solidproject.org/t/how-to-request-a-refresh-token/4025/8 "2021-07-26T08:31:10Z")
> [@jeffz](#): > > The ESS token expires after **30 minutes** As a heads-up for people reading this in the future, I’ve heard that this expiry time is likely to be lowered even further in the future. Instead, every request you do will also result in a new refresh token being returned in the response, which you can then use for your next request (“refresh token rotation” is the term to enter in your search engine I believe). (As for updates on the progress, the GitHub issue is probably best to follow, and it looks like there hasn’t really been any, unfortunately.) ---
**Author:** ![vkraus](https://avatars.discourse-cdn.com/v4/letter/v/c5a1d2/32.png) [@vkraus](https://forum.solidproject.org/u/vkraus)\ **Post date:** [July 26, 2021, 12:28pm UTC](https://forum.solidproject.org/t/how-to-request-a-refresh-token/4025/9 "2021-07-26T12:28:20Z")
> Instead, every request you do will also result in a new refresh token being returned in the response This would be very unfortunate, because most OIDC implementation, just like Apple, don’t want the refresh token stored on the device. This would drive us further away from the currrent web, so there needs to be strong reasons for that. ---
**Author:** ![jeffz](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.solidproject.org/jeffz/32/600_2.png) [@jeffz](https://forum.solidproject.org/u/jeffz)\ **Post date:** [July 26, 2021, 4:48pm UTC](https://forum.solidproject.org/t/how-to-request-a-refresh-token/4025/10 "2021-07-26T16:48:58Z")
[disclaimer, I do not work for Inrupt and do not represent them] My understanding is that a) out-of-browser access is (understandably) low priority for Inrupt, that b) we should not expect a longer token from them any time soon c) that when they do fix it, it will be a solution using verifiable credentials, which will provide a complete solution. It’s also my understanding that it already _is_ a rotation token but that step does not solve all the issues.