第三方应用是否已开放Refresh Token授权？原2016年禁止政策是否调整？
Hey Joshua, thanks for reaching out with this question—it’s a common one for developers digging through legacy policy documentation. Let’s break this down clearly:
Current Policy Status
As of now, third-party applications are allowed to use Refresh Tokens to obtain new access tokens, which represents a definite shift from the 2016-era restrictions you mentioned.
What Changed After 2016?
The original 2016 ban was driven by early security concerns around improper Refresh Token handling—things like storing tokens in insecure client-side environments (browsers, unprotected mobile app frontends) that put user data at risk. Since then, the industry has standardized robust OAuth 2.0 security practices, and our platform updated its policy to align with these best-in-class standards.
To use Refresh Tokens compliantly, your app must follow these core rules:
- Store Refresh Tokens exclusively on secure backend servers—never expose them in client-side code where they could be intercepted.
- Request only the minimal permission scopes your app actually needs (stick to the principle of least privilege).
- Implement token rotation: when using a Refresh Token to fetch a new access token, replace the old Refresh Token with the updated one provided in the response.
- If a Refresh Token expires or gets invalidated (e.g., the user revokes your app’s access), redirect the user to re-authenticate instead of trying to bypass the authorization flow.
Quick Caveat
If you’re working with highly sensitive enterprise-specific APIs on our platform, there might be additional restrictions in place. Be sure to cross-reference the latest API documentation tailored to your use case to avoid any missteps.
内容的提问来源于stack exchange，提问作者Joshua Kirch
