Tcl

Refresh OAuth2 Access Token with Optional Params

See more OAuth2 Examples

Demonstrates how to refresh an OAuth2 access token with optional query params included in the HTTP request. Tcl

load ./chilkat.dll

set success 0

# Here is a sampling of possible optional parameters that might
# be used by some OAuth2 providers.

# Optional Parameters
# 
#     "scope":
#         Specifies the scope of the access request. If omitted, the authorization
#         server may issue a token with the same scope as the original token.
#         Example: "scope=read write"
# 
#     "redirect_uri":
#         The redirect URI used in the original authorization request. Some
#         servers may require this for validation.
#         Example: "redirect_uri=https://example.com/callback"
# 
#     "resource":
#         Indicates the target resource or audience for the token. This is used in
#         some implementations (e.g., Microsoft Identity Platform).
#         Example: "resource=https://api.example.com"
# 
#     "audience":
#         Similar to "resource", this specifies the intended audience for the
#         token (used in some OAuth2 implementations like Auth0).
#         Example: "audience=https://api.example.com"
# 
#     "client_assertion" and "client_assertion_type":
#         Used for client authentication using a signed JWT instead of a client
#         secret.
#         Example:client_assertion=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...        
#         client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
# 
#     "token_type_hint":
#         Provides a hint to the authorization server about the type of token
#         being refreshed. This is rarely used but can be helpful in some cases.
#         Example: "token_type_hint=refresh_token"
# 
#     "assertion":
#         Used in some flows (e.g., SAML bearer assertion flow) to provide an
#         assertion for token issuance.
#         Example: "assertion=PHNhbWxwOl..."
# 
#     "requested_token_use":
#         Specifies how the token will be used (e.g., "on_behalf_of" in the
#         On-Behalf-Of flow used by Microsoft Identity Platform).
#         Example: "requested_token_use=on_behalf_of"
# 

# --------------------------------------------------------------------------------
# This example wll refresh the access token and includes the "audience"
# optional query parameter.
# 
# 

# Get the access token to be refreshed.
set jsonToken [new_CkJsonObject]

set success [CkJsonObject_LoadFile $jsonToken "qa_data/tokens/myAccessToken.json"]
if {$success != 1} then {
    puts "Failed to load hmrc.json"
    delete_CkJsonObject $jsonToken
    exit
}

set oauth2 [new_CkOAuth2]

CkOAuth2_put_TokenEndpoint $oauth2 "https://api.example.com/oauth/token"

# Replace these with actual values.
CkOAuth2_put_ClientId $oauth2 "CLIENT_ID"
CkOAuth2_put_ClientSecret $oauth2 "CLIENT_SECRET"

# Add the optional refresh query param.
# Call AddRefreshQueryParam multiple times to add additional params.
CkOAuth2_AddRefreshQueryParam $oauth2 "audience" "https://api.example.com"

# Provide the existing refresh token from the JSON.
CkOAuth2_put_RefreshToken $oauth2 [CkJsonObject_stringOf $jsonToken "refresh_token"]

# Send the HTTP POST to refresh the access token..
set success [CkOAuth2_RefreshAccessToken $oauth2]
if {$success != 1} then {
    puts [CkOAuth2_lastErrorText $oauth2]
    delete_CkJsonObject $jsonToken
    delete_CkOAuth2 $oauth2
    exit
}

# Load the access token response into the json object 
CkJsonObject_Load $jsonToken [CkOAuth2_accessTokenResponse $oauth2]

# Save the new JSON access token response to a file.
# The access + refresh tokens contained in this JSON will be needed for the next refresh.
set sbJson [new_CkStringBuilder]

CkJsonObject_put_EmitCompact $jsonToken 0
CkJsonObject_EmitSb $jsonToken $sbJson
CkStringBuilder_WriteFile $sbJson "qa_data/tokens/myAccessToken.json" "utf-8" 0

puts "OAuth2 access token refreshed!"
puts "New Access Token = [CkOAuth2_accessToken $oauth2]"

delete_CkJsonObject $jsonToken
delete_CkOAuth2 $oauth2
delete_CkStringBuilder $sbJson