# Google broker and token refresh

**URL:** <https://forum.keycloak.org/t/google-broker-and-token-refresh/31292>\
**Category:** Getting advice\
**Created:** [March 5, 2026, 2:15pm UTC](https://forum.keycloak.org/t/google-broker-and-token-refresh/31292 "2026-03-05T14:15:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yo-grd](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/yo-grd/32/12497_2.png) [@yo-grd](https://forum.keycloak.org/u/yo-grd)\
**Post date:** [March 5, 2026, 2:15pm UTC](https://forum.keycloak.org/t/google-broker-and-token-refresh/31292/1 "2026-03-05T14:15:44Z")

</div>

Hello,

We use Keycloak for authentication via our Google accounts in our Angular application (via keycloak-js).  
No problem, it works perfectly.

We now want to use the Google token to call Google APIs directly.

So we call the broker endpoint to retrieve a token (store token on, api scopes, prompt consent, access\_type offline).  
This works very well… for 1 hour.

After that, the Google token expires, and Keycloak always returns the same one even we recalls broker token endpoint and we get 401 from Google.

The only way to get a new token is to destroy the Keycloak session (delete the cookies).  
I don’t understand why.

Thanks.

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [March 6, 2026, 8:52pm UTC](https://forum.keycloak.org/t/google-broker-and-token-refresh/31292/2 "2026-03-06T20:52:21Z")

</div>

Which version of Keycloak do you run?  
There was an enhancement in 26.4: [External IDP tokens are not refreshed automatically for OAuth2 & OIDC IDPs when retrieving the external token · Issue #14644 · keycloak/keycloak · GitHub](https://github.com/keycloak/keycloak/issues/14644)  
I don’t know if this fixes your issue.  
There’s a follow up, not yet fixed: [Make sure refreshing external tokens possible · Issue #46582 · keycloak/keycloak · GitHub](https://github.com/keycloak/keycloak/issues/46582)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/free1/uploads/keycloak/original/1X/eb342909d95cf32cbb7517610022c6a0046a9ffb.png) [@system](https://forum.keycloak.org/u/system)\
**Post date:** [September 2, 2026, 8:53pm UTC](https://forum.keycloak.org/t/google-broker-and-token-refresh/31292/3 "2026-09-02T20:53:11Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.