passport-oauth2-refresh-token

OAuth 2.0 refresh token authentication strategy for Passport.

This module lets you identify requests containing a refresh_token in the request body when refreshing an access token, as defined by the OAuth 2.0 specification. This strategy would be used as an alternative to HTTP Basic or Client Credentials authentication because the client was not issued any credentials on registration (because the client is likely in a category of clients that are not able to reliably keep their secrets).

Install

$ npm install passport-oauth2-refresh-token

Usage

Configure Strategy

The OAuth 2.0 refresh token "authentication" strategy identifies clients using only a refresh token. The strategy requires a verify callback, which accepts the refresh token and calls done, providing a client.

passport.use(new RefreshTokenStrategy(
	function(token, done) {
		RefreshTokens.findOne(
			{
				where: { token: token },
				include: [Clients]
			},
			function (err, refreshToken) {
				if (err) { return done(err); }
				if (!refreshToken) { return done(null, false); }
				return done(null, refreshToken.client);
			}
		);
	}
));

Authenticate Requests

Use passport.authenticate(), specifying the 'oauth2-refresh-token' strategy, to "authenticate" requests. This strategy is typically used in combination with HTTP Basic authentication (as provided by passport-http), OAuth2 Client Password (as provided by passport-oauth2-client-password), and OAuth2 Public Password (as provided by passport-oauth2-public-password), allowing clients without credentials to exchange refresh tokens for access tokens.

For example, as route middleware in an Express application, using OAuth2orize middleware to implement the token endpoint:

app.post(
	'/oauth/token',
	passport.authenticate(['basic', 'oauth2-client-password', 'oauth2-public-client', 'oauth2-refresh-token'], { session: false }),
	oauth2orize.token()
);

Tests

$ npm install --dev
$ make test

Credits

• Jared Hanson (Client Password implementation)
• Tim Shadel (Public Client implementation)
• getsnoopy

License

The MIT License

Copyright (c) 2025 getsnoopy