Requesting data through the Data API can be available to everyone (public data) or only to authorised users (private data). For the second group, a valid access token is required. With the new refresh token flow for the Data API, users can extend their active sessions, instead of starting a new one.

Data API consumers with JWT, can now use a refresh token flow to extend the access token expiration, instead of having to login again every time a JWT is expired.

Refresh token

The login mutation has been updated to return a refreshToken:

mutation login{
     login(
     username: "<username>", 
     password: "<password>", 
     authProfileUuid: "<authProfileUuid>"
     ){
       isValid
       jwtToken
       refreshToken
     }
}

This token can be used in a new mutation refreshToken with the purpose of extending your login by returning a new access token jwtToken. Be aware, that for security reasons the refreshToken can only be used once, and the user will receive a new one after the mutation has been completed:

mutation refresh{
     refreshToken(
     token: "<refreshToken>"
     ){
       isValid
       jwtToken
       refreshToken
       refreshExpiresIn
     }
}

Revoking a token

A refreshToken can be also revoked at any time, using the revokeRefreshToken mutation:

mutation revoke{
     revokeRefreshToken(
     token: "<refreshToken>"
     ){
       removed
       refreshId
     }
}

➝ Next article: Data API Access & Refresh token lifetimes