Does refresh_token make sense with client credentials oauth flow?

Question

I am testing keycloak for learning purposes. I am testing the client credentials flow token endpoint to return a jwt for rest api use.

The endpoint returns an access_token and a refresh_token (refresh token is disabled by default unless I enable it in console for the client). I can call the same token endpoint with a refresh token generated from the first client credentials call but it still requires a client secret.

Is it not possible to regenerate an access token in the client credentials flow with just a refresh token?

If not why would I ever bother to pass a grant_type of refresh_token - wouldn't I just call the client_credential flow again since they both require a client secret? I have to guess the answer will be that refresh tokens don't make sense to be used with client_credential flows?

token parameters:

refresh token parameters:

Answer 1

You guess right, refresh tokens don't make sense for the client_credentials grant type. Refresh tokens are used for interactive clients i.e a person. The idea of the refresh token is to remove the requirement for them to have to frequently re-authenticate e.g re-enter their username and password, whilst still allowing the token expiry time to be kept short. The reason you want to keep the expiry time short is that once it is issued it is usually not possible to revoke it. On the other hand if an account has been suspended or the password has been changed and a refresh token has been presented the reissuing of the token can be refused by the identity provider.

As the client credentials flow is used for machine to machine authentication frequently re-authenticating is not a problem. The OAuth RFC specifically states "refresh token SHOULD NOT be included." in the response for the client_credentials grant type.