In exports.onExecutePostLogin the event.refresh_token is always null

Help
,
1

Ready to post? :mag: First, try searching for your answer.
We are using refresh token rotation, and we would like to return the refresh token expiration date as a custom claim in the accessToken.

In the documentation it’s mentioned that it’s possible to get the refresh token inside the on post login action, however in our case it’s always returned as null.

Is there any further configuration needed?

Code :

exports.onExecutePostLogin = async (event, api) => {

// Here event.refresh_token is always null!!
    const refreshTokenExpiration = event.refresh_token?.expires_at;

if(refreshTokenExpiration != null) {
  // Add refresh token expiration as a custom claim
  api.accessToken.setCustomClaim("refreshTokenExpiresAt", refreshTokenExpiration);
}

}
3

Hi @mounare,

Welcome to the Auth0 Community!

Can you confirm that you have implemented refresh token exchange in your application(s)? The event.refresh_token object is populated by refresh token exchange flows: Use Refresh Token Rotation

Thanks,

Mary Beth

4

Actually, we are using the flutter auth0 official sdk, and using the CrendentialManager to login and refresh the token. So I suppose yes the exchange is implemented?
As we are able to perform refreshes in the app.

5

HI @mounare,

Thanks for confirming! I reread the documentation and it states that event.refresh_token provides relevant information for existing refresh_tokens. It could be that there are no existing refresh tokens for that user at the time of action execution. Can you check?

Also, can you confirm that your API in Auth0 has offline_access enabled?

Best,

Mary Beth

7

Hello Mary Beth,

We double checked that the offline access is enabled, and that in the app we do have a refresh token, but still have a null refresh token in the action.

8

Hi @mounare,

I reached out internally and confirmed that accessing the Session and Refresh Token APIs is only accessible to Enterprise customers. Therefore, it is not possible on a Free account to use event.refresh_token in an action, unfortunately.

Thanks,

Mary Beth

9

Hello Mary Beth,

I checked with my team and our plan is “B2B - Essentials”. Isn’t it supported for this kind of plan?

10

Hi @mounare,

I confirmed with the team that event.refresh_token is available for Enterprise customers only.

Thanks,

Mary Beth

11

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.