title: How to implement OAuth2 Code flow with automatic refresh token grant
body: <p>We have just started out with ASP.NET Web API 2 and implemented <em>OAuth2</em> client credential token grant, resource owner token grant (for internal apps) as well as <em>code flow token Grant for third party Vendors</em>.</p>
  
  <p>For code flow, when the refresh token is exchanged for a new access token and refresh token the original token is removed from the token store and as such invalidated. The resource owner can also at any time revoke an access token and its associated refresh token.</p>
  
  <p>One of our vendors will follow the code flow grant as there is a requirement that the resource owner or representative authorizes the access to the resource server.</p>
  
  <p>The vendor subsequently requested that <em>instead of the normal flow</em> to redeem the refresh token for a new access token and refresh token, that the <em>host server automatically provide a new access token and refresh token for each request</em>.</p>
  
  <p>The idea that over and above servicing the request, the host API calls back to a pre-determined endpoint on the client domain that will provide a new access token and refresh token.</p>
  
  <p>It goes without saying that such an arrangement introduces complexity within the host API and it would defeat the whole point of short lived tokens and longer lived refresh tokens and we would probably implement other measures to prevent token hi-jacking and other types of attacks.</p>
  
  <p>Currently our authorization server and resource server is one and the same. We would however want to keep the option open to separate the authorization server from the resource in future.</p>
  
  <p><strong>The questions from this then:</strong></p>
  
  <ol>
  <li>Should we consider this arrangement at all?</li>
  <li>Would it make sense to adjust to a never expiring access token and not issue a refresh token with the token request?</li>
  </ol>