# Do I need to store IDP access\_token + refresh\_token on my own, or I can use Auth0?

**URL:** <https://community.auth0.com/t/do-i-need-to-store-idp-access-token-refresh-token-on-my-own-or-i-can-use-auth0/8801>\
**Category:** Get Help\
**Tags:** tokens, idp, access\_token, refresh\_token\
**Created:** [November 22, 2017, 2:26am UTC](https://community.auth0.com/t/do-i-need-to-store-idp-access-token-refresh-token-on-my-own-or-i-can-use-auth0/8801 "2017-11-22T02:26:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![m.bellino](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/m.bellino/32/3660_2.png) [@m.bellino](https://community.auth0.com/u/m.bellino)\
**Post date:** [November 22, 2017, 2:26am UTC](https://community.auth0.com/t/do-i-need-to-store-idp-access-token-refresh-token-on-my-own-or-i-can-use-auth0/8801/1 "2017-11-22T02:26:32Z")

</div>

After I successfully authenticate on an external IDP, I can use the Management API to retrieve the IDP access\_token and refresh\_token.  
Using the IDP access\_token I’ll be able to call the services provided by the IDP.  
And using the IDP /refresh endpoint I’ll be able to obtain a new access\_token + new refresh\_token.  
But, at this point, I’ll be forced to store the new tokens on my own database?  
Or is there a way to update the old tokens values contained in Auth0 identities[0] with the new values I got from the IDP?

---

<div class="post-metadata">

**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\
**Post date:** [November 22, 2017, 7:27pm UTC](https://community.auth0.com/t/do-i-need-to-store-idp-access-token-refresh-token-on-my-own-or-i-can-use-auth0/8801/2 "2017-11-22T19:27:44Z")

</div>

To my knowledge, those properties are only settable at authentication time when the authentication flow is processed through Auth0 so if the underlying identity provider issues a new refresh token you should store it in your own data store.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:57am UTC](https://community.auth0.com/t/do-i-need-to-store-idp-access-token-refresh-token-on-my-own-or-i-can-use-auth0/8801/3 "2018-03-02T05:57:30Z")

</div>