How to get refresh token on Android

Question

I am developing Android application that requires sign in with Microsoft. I need to get authorization code to send it to our server. On the server I exchange the authorization code to refresh token and access token. I need access token to communicate with users' accounts. And refresh token to get new access token when old expires. I found libraries com.microsoft.identity.client to get access token. com.microsoft.identity.client gets authorization code and refresh token inside itself. But there is no way to get these values from outside. Only access token available in result of com.microsoft.identity.client. So, when this access token expires, server can do nothing. My question is how to get refresh token (not access token) in mobile application? Or how to get authorization code in mobile application (then I can exchange it to refresh token on server)?

Answer 1

Hi @Wellnessliving ,

Thanks for reaching out.

I understand you are trying to get the refresh token for android application. Unfortunately, currently it is not possible to get the refresh token for android application due to security concerns.

Exposing the refresh token from MSAL would too easily enable developers to implement scenarios to transmit access tokens or refresh tokens off the device for use elsewhere (that is, except by the intended resource server) -- the refresh token is intended to remain on the device to which it was transmitted. It is also to protect credentials from being compromised by man-in-middle or other kinds of interception attacks.

Hope this will help.

Please remember to "Accept Answer" if answer helped you.