Alexa账号关联隐式授权流程：访问令牌过期及刷新相关问题

Great questions—let's break this down step by step since implicit grant flow has some specific quirks when it comes to Alexa account linking:

1. What to do when an already linked access token expires? #

First, it’s critical to remember that the implicit grant flow does not issue refresh tokens (this is part of the OAuth 2.0 spec for this flow, designed for client-side apps where storing a refresh token securely isn’t feasible). That means when your access token expires, there’s no way to get a new one without the user going through the account linking process again.

Your only viable path here is to trigger a re-authorization flow for the user to obtain a fresh access token.

2. How to guide users to re-login and get a new access token (for 1-year validity tokens)? #

You’ll need to build logic into your Alexa skill to detect token expiration, then prompt the user to re-link their account. Here’s how to implement this:

• Track token expiration: Store the access token’s expiration timestamp (or the expires_in value returned during initial linking) alongside the token itself. Check this timestamp before making any API calls that require the token.
• Trigger re-linking in your skill: When you detect the token is expired (or about to expire), return a response that includes a LinkAccount card. Alexa will push this card to the user’s Alexa mobile app.
• User experience flow: The user will see the card in their app, tap it, and be redirected to your authorization page. If your auth page supports "silent re-authorization" (i.e., recognizing a logged-in user session), you can auto-approve the request and issue a new access token without requiring the user to re-enter credentials. If not, the user will log in again, and the new token will be linked to their Alexa skill automatically.
• Update stored tokens: Once the new token is issued, make sure your skill’s backend (or storage) replaces the old expired token with the fresh one.

3. Can I share a refresh token with Amazon instead of an access token? #

No, this isn’t possible—here’s why:

• The implicit grant flow, by design, does not generate refresh tokens. OAuth 2.0 restricts refresh tokens to authorization code flow (where you have a secure backend to store them), since implicit flow is intended for client-side applications that can’t safely store sensitive credentials like refresh tokens.
• Amazon’s Alexa account linking implementation for implicit flow doesn’t support receiving or using refresh tokens. You can only share the access token generated during the initial (or re-) authorization flow, and you’ll need to handle re-authorization when that token expires.

内容的提问来源于stack exchange，提问作者Prithivi Raj