[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-05 UTC。"],[],[],null,["# Antipattern: Issuing refresh tokens without invoking refresh flow\n\n*You're viewing **Apigee** and **Apigee hybrid** documentation.\nView [Apigee Edge](https://docs.apigee.com/api-platform/antipatterns/issuing-refresh-tokens) documentation.*\n\n\nRefresh tokens are used to obtain new access tokens after the original access\ntoken has expired or been revoked. Refresh tokens are optionally issued along\nwith access tokens with some of the grant types.\n\nAntipattern\n-----------\n\n\nRefresh tokens can be issued either by Apigee or via external resources.\nHowever, this is an antipattern if the refresh token is never used via the\nRefreshAccessToken operation.\n\nImpact\n------\n\n\nPersisting refresh tokens unnecessarily negatively impacts both performance\nand reliability of the authentication system.\n\nBest practice\n-------------\n\n### If the refresh token is never needed\n\n\nIf refresh tokens are not needed, developers should use the 'client\ncredentials' or 'implicit' grant types when generating new access tokens.\nThese grant types do not issue refresh tokens, which is desirable if the\nrefresh token functionality is not required.\n\n### If the proxy performs only read operation with refresh tokens\n\n\nApigee offers\n[GetOAuthV2Info](https://cloud.google.com/apigee/docs/api-platform/reference/policies/get-oauth-v2-info-policy#refresh-token) which can be used to retrieve refresh token\nattributes. Developers should not use this policy to validate refresh tokens.\nIt is an antipattern that the refresh token is never used to exchange for a\nnew access token. Note that Apigee can work with\n[external access and refresh tokens](/apigee/docs/api-platform/security/oauth/use-third-party-oauth-system). If the refresh token flow happens\noutside of Apigee, it's highly recommended to use the RefreshAccessToken\noperation such that any imported refresh tokens no longer valid are properly\nremoved from the Apigee system.\n\nFurther reading\n---------------\n\n[Refreshing an access token](/apigee/docs/api-platform/security/oauth/access-tokens#refreshinganaccesstoken)"]]
