How does FusionAuth handle storage of refresh tokens for third party services?

[dan]

How does FusionAuth handle storage of refresh tokens for third party services where the user has authorized storage of a refresh token (for google, Facebook, etc)?

[dan]

This is an example of Third-party Service Authorization.

We store the tokens on the Link, but leave the refresh operation up to the software needing to access the third party API.

This approach has some tradeoffs, but gives more granular control to the application that needs the access token.

How it works:

• The developer sets up an 'authorize' button in their application
• We take care of the authorization/authentication/storage of the refresh token.

... time passes

• When they need an access token, they call our APIs to get the refresh token for a particular user
• They call the 3rd party service to get the access token,
• They use the access token.

If the access token expires while they need it, they can get the refresh token again and then get an access token.