Lock.Android: Refresh JSON Web Tokens

By default, delegation is disabled for tenants without an add-on in use as of 8 June 2017. Legacy tenants who currently use an add-on that requires delegation may continue to use this feature. If delegation functionality is changed or removed from service at some point, customers who currently use it will be notified beforehand and given ample time to migrate.

When an authentication is performed with the offline_access scope included, the returned Credentials will contain a Refresh Token and an ID Token. Both tokens can be used to request a new Access Token and avoid asking the user their credentials again.

We need to store the tokens in a secure storage after a successful authentication. Keep in mind that Refresh Tokens never expire. To request a new token you'll need to use auth0.android's AuthenticationAPIClient. Don't forget to request the same scope used in the first login call.

String refreshToken = // Retrieve Refresh Token from secure storage
Auth0 account = new Auth0("YOUR_CLIENT_ID", "YOUR_DOMAIN");
auth0.setOIDCConformant(true);

AuthenticationAPIClient client = new AuthenticationAPIClient(auth0);
client.renewAuth(refreshToken)
  .addParameter("scope", "openid email")
  .start(new BaseCallback<Credentials, AuthenticationException>() {
    @Override
    public void onSuccess(Credentials credentials) {
      //SUCCESS
      String accessToken = credentials.getAccessToken();
    }

    @Override
    public void onFailure(AuthenticationException error) {
        //FAILURE
    }
});

Was this helpful?/

String idToken = // Retrieve ID Token from the secure storage
Auth0 account = new Auth0("YOUR_CLIENT_ID", "YOUR_DOMAIN");
auth0.setOIDCConformant(true);

AuthenticationAPIClient client = new AuthenticationAPIClient(auth0);
client.delegationWithIdToken(idToken)
  .setScope("openid email")
  .start(new BaseCallback<Delegation, AuthenticationException>() {
    @Override
    public void onSuccess(Delegation delegation) {
        //SUCCESS
        String idToken = delegation.getIdtoken();
    }

    @Override
    public void onFailure(AuthenticationException error) {
        //FAILURE
    }
  });

Was this helpful?/

Docs

Lock.Android: Refresh JSON Web Tokens

Lock.Android: Refresh JSON Web Tokens

Using Refresh Token

Using a non-expired ID Token

Was this article helpful?