Alexa Account Linking - What to do if access token linked is expired? I am using Implicit grant flow

Question

​I am trying to use Implicit grant flow for alexa account linking. My access token is valid only for one year.

1. How to ask the user to login again to get the new access token?
2. Can I share refresh token instead of access token with Amazon?

Answer 1

In your API check if the access token is still valid. If it is not then send an account linking card and tell the user that they need to check their Alexa app to relink their account. Here's how you send an Account Linking card using the Alexa Skills Kit SDK for Node.js (v2) (see the withLinkAccountCard() call):

const OrderCarIntentHandler = {

  // ...

  handle(handlerInput){

    // This intent requires an access token so that we can get the user's
    // Ride Hailer user profile with payment information.

    // The access token is in the Context object. Access the
    // request in the HandlerInput object passed to the
    // handler.

    var accessToken = handlerInput.requestEnvelope.context.System.user.accessToken;

    if (accessToken == undefined){
        // The request did not include a token, so tell the user to link
        // accounts and return a LinkAccount card
        var speechText = "You must have a Ride Hailer account to order a car. " +
                    "Please use the Alexa app to link your Amazon account " +
                    "with your Ride Hailer Account.";

        return handlerInput.responseBuilder
            .speak(speechText)
            .withLinkAccountCard()
            .getResponse();
    } else {

        // Use the token to access the user's profile. This should also verify that the
        // token represents a valid Ride Hailer user.

        // ...

    }
  }
}; 

https://developer.amazon.com/en-US/docs/alexa/custom-skills/include-a-card-in-your-skills-response.html#define-a-card-for-use-with-account-linking

The user now needs to re-link the account and get the new access token.

If you need refresh token then use the Authorization Code Grant instead of Implicit Grant.

Hope this helps!

Answer 2

If you are using Implicit Grant, there is no Refresh Token. What you suppose to do, when the token expire, display card to redirect to your Authorization Server.