<div dir="ltr">Hi, <div><br></div><div>I noticed that when I request an access token (curl -v -H "Content-type: application/x-www-form-urlencoded" <a href="http://localhost:8080/auth/rest/realms/keycloak-admin/tokens/grants/access">http://localhost:8080/auth/rest/realms/keycloak-admin/tokens/grants/access</a> --data "client_id=...&client_secret=...&username=...&password=..." -H "Accept: application/json"), the response doesn't contain a refresh token. </div>
<div><br></div><div>Is this intentional? And might it change in future versions?</div><div><br></div><div>According to <a href="http://tools.ietf.org/html/rfc6749#section-4.3">http://tools.ietf.org/html/rfc6749#section-4.3</a> (which is the spec the above method implements, right?), the refresh token in the access token response is optional.</div>
<div><br></div><div>If I'm not mistaken, adding .generateRefreshToken() here: <a href="https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/services/resources/TokenService.java#L201">https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/services/resources/TokenService.java#L201</a></div>
<div>should do the trick, right?</div><div><br></div><div>Cheers,</div><div>Nils</div>
</div>