Generate an Access OAuth2 Token Without Invalidating the Refresh Token

Question

I am trying to use Singer and Meltano—external ELT tools—to create an integration with LucidChart's API. This integration would allow for data to be pulled from a user's LucidChart account to populate a database or other storage medium. However I am running into an issue with the way LucidChart handles refresh tokens.
As I understand it when I use the offline_access scope to have the user generate a refresh token I can then use this refresh token to request an access token any time within the next six months. However when I do so I also generate a new refresh token and invalidate the previous one. This makes my use case very difficult as I might potentially have multiple processes running at once attempting to use the LucidChart API. Awkward race conditions occur where one process attempts to use a refresh token that has been invalidated by another process.
Is there any way around this difficulty? Is there any way to generate an access token without invalidating the refresh token that was used to obtain it?

Michael B · Accepted Answer

Hello SebastianUnfortunately per the OAuth2 spec there is no way to refresh a token without invalidating the previous token. There is a 1 minute grace period where subsequent refresh token requests with the same token will return the new token/refresh token. However if your various processes all run at different frequencies this would not help you.We recognize that this is not optimal in a variety of use cases. Feedback like yours allows us to prioritize what new features to build including alternative authentication methods. I"ll submit this conversation but you could help reinforce the need by posting in ourProduct Feedback section.

Reply

Create an account in the community

Login with SSO

Log in to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded