Ionize Documentation What is Ionize Architecture Repo Map License Glossary

Dashboard API Authentication Dashboard API Errors Dashboard API Pagination Dashboard Settings API SDK Settings API

Environment variables

OAuth2 grant types Authorization Code Authorization Code + PKCE Client Credentials Refresh Token Implicit Resource Owner Password Credentials

ReferenceGrants

Refresh Token

Client exchanges refresh token for a new access token (and a new refresh token — Hydra rotates).

Refresh Token

Spec: RFC 6749 §6

Supported in Ionize: Yes

When to use

Renewing access tokens without re-authenticating the user.

How it works

Client exchanges refresh token for a new access token (and a new refresh token — Hydra rotates).

Integration guide

See /docs/integrate/oauth2-refresh-tokens for full setup.

Related

Integrate — OAuth2 overview
Security — PKCE enforcement

Client Credentials

Confidential client POSTs `grant_type=client_credentials` with its credentials. Hydra returns an access token (no refresh, no ID token).

Implicit

Returned tokens directly in the authorization URL fragment. Insecure (token in URL, browser history, referrer).

On this page

Refresh Token When to use How it works Integration guide Related