Olympus Documentation What is Olympus Architecture Repo Map License Glossary

Athena API Authentication Athena API Errors Athena API Pagination Athena Settings API SDK Settings API

Environment variables

OAuth2 grant types Authorization Code Authorization Code + PKCE Client Credentials Refresh Token Implicit Resource Owner Password Credentials

ReferenceGrants

Refresh Token

Client exchanges refresh token for a new access token (and a new refresh token, Hydra rotates).

Refresh Token

Spec: RFC 6749 §6

Supported in Olympus: Yes

When to use

Renewing access tokens without re-authenticating the user.

How it works

Client exchanges refresh token for a new access token (and a new refresh token, Hydra rotates).

Integration guide

See /docs/integrate/oauth2/oauth2-refresh-tokens for full setup.

Related

Integrate, OAuth2 overview
Security, PKCE enforcement

Client Credentials

Confidential client POSTs `grant_type=client_credentials` with its credentials. Hydra returns an access token (no refresh, no ID token).

Implicit

Returned tokens directly in the authorization URL fragment. Insecure (token in URL, browser history, referrer).

On this page

Refresh Token When to use How it works Integration guide Related