如何无限期使用一个访问令牌/刷新令牌（oauth2-Spotify API）

Question

I'm developing an application that will only use one Spotify account ever, and I don't quite understand the refresh token (using oauth2). Ideally, I'd like to just use the Spotify API console to receive an access token and refresh token once that I can use forever and not have to worry about authorization again while the application is running. If I have a refresh token, can I just use that refresh token forever or do I need to constantly get a new token with that refresh token whenever I want to access the API?

Answer 1

TLDR: You don't need to refresh access keys for every call, but you do have to refresh the access key if it expires.

Refresh tokens are part of the OAuth2 flow. Access keys are short lived and expire, while refresh tokens are long lived. You can use the refresh token with your client secret to get new access tokens when your access token expires. This is a security measure. In the event your access token is leaked, it is only short lived without the refresh token and client secret. In the event your refresh token is leaked, you can have that blacklisted.

There are some exceptions if you're not accessing private data. The Spotify authorization guide has a Client Credentials flow that does not require refreshes but is also limited in what type of data it can access.