Recently, I delved into the world of OAuth by experimenting with Patreon's API. As someone who is relatively new to the OAuth process, I relied on Patreon's Javascript Package to assist me in handling the requests.
- NPM: https://www.npmjs.com/package/patreon
- Patreon Documentation:
Up until now, I have successfully obtained the token through the following code snippet:
import * as patreon from 'patreon';
const patreonOAuthClient = patreon.oauth(clientId, clientSecret);
patreonOAuthClient.getTokens(oauthGrantCode, redirectURL).then((tokenResponse) => {
console.log(tokenResponse);
})
The token I receive is structured like this:
// Example Token from getTokens()'s then()-response
tokenResponse = {
access_token: "UbHYT3H51GpeYueBeBuvBj1fnEFzv5A5870s_rYeMHo",
expires_in: 2678400,
refresh_token: "AP5aAw-gJbVf35tWxQb74rmJJz2MhwIYq660m0jiZQ4",
scope: "my-campaign pledges-to-me users",
token_type: "Bearer",
version: "0.0.1"
}
Currently, I am struggling with getting the refresh token to work on my local server in order to avoid repeatedly asking for user permissions every month.
However, when attempting to use the refresh token method, I am faced with a 400 Bad Request:
patreonOAuthClient.refreshToken(tokenResponse).then(response => {
console.log(response, 'success!');
}).catch(err => {
console.log(err, ':(');
});
Although not explicitly mentioned in the npm documentation, the refreshToken() method can be found in the github source code of the Patreon package.
As per the information provided here in their API documentation:
If you wish to get up-to-date information after the token has expired, a new token may be issued to be used for the following month. To refresh a token, make a POST request to the token endpoint with a grant type of refresh_token, as in the example. You may also manually refresh the token on the appropriate client in your clients page.
My main query revolves around whether the 400 error is a result of needing to wait a month to refresh the token or if my implementation of the API is incorrect. I am seeking advice from those more experienced in OAuth to clarify whether token refreshes should be done before or after the token expiration period.
(Regarding refreshing the token before expiration, is there an optimal way to time this for an express server without negatively impacting memory by adding a timeout for each token renewal?)