Unlimited refresh token from SPA

[benjamin.coenen]

Hello, I’m currently trying to generate unlimited refresh token (without any rotation) and fetching it directly thanks the the auth0 react library. I saw it could work only if we enable the refresh token rotation. Then if I enable the refresh token rotation it’s not longer an unlimited refresh token. I know this is not a good practice. But I would like to generate an unlimited token to let my users use this token as an API key into their scripts and then be able to use it without changing it everyday. Do you have a better solution for me ? To answer this use case

[benjamin.coenen]

BTW I already read this topic Id token and refresh token from in react app - #3 by stephanie.chamblee

[dan.woda]

Hi @benjamin.coenen,

Welcome to the Auth0 Community!

The Auth0 react library does not have this functionality as it would be insecure.

You should be issuing a set of client credentials as a new third-party application for each developer if you would like to provide your users with developer access to an API. We do not have an API key feature or direct equivalent.

If you search the forum there are topics discussing how to set this up. For example:

How to implement API keys using Auth0?

We are trying to generate API keys to our services using Auth0 and we are wondering what the best approach is. What we want to give out to our customers is an app_id and an app_secret which they can include in their calls to our APIs in order to get access. Our current Auth0 solution for this would be: Create a Non Interactive Client for the customer Authorize this client access to the APIs needed Give out the ClientID/ClientSecret as app_id and app_secret to the customer On requests contain…

Hope this helps!

P.S. If you reply to your own topic it knocks it out of our unanswered queue and will often go unanswered.