Comment by another_twist | Hacker News Reader

Top New Best Ask Show Jobs

Comment by another_twist | Hacker News Reader

Parent Full thread

another_twist·

I know but the RFC doesnt mandate it. https://datatracker.ietf.org/doc/html/rfc6749#section-6

Not sure why Google doesnt do this but Atlassian does.

Google OAuth2 refresh tokens are definitely singe use.

Atleast not documented here https://developers.google.com/identity/protocols/oauth2#5.-r.... They have a limit on the number of tokens but not on number of uses per token.

Reply on news.ycombinator.com