Refreshing token works via REST works in Postman but not in C#

Getting advice
1

I can’t figure out where the problem is coming from.

I first created the proper login requests for the tokens using Postman. I’m able to get both the refresh_token and access_token. I can also refresh the access_token using Postman.

This is the “Login” scheme:

image
image2058×1220 171 KB

This refreshes the access_token successfully:

image
image2042×1207 161 KB

Now, you can see the C# code to the right. This code works for the “Login”, i.e. I get the initial access_token and refresh_token.

However, when I later try to refresh the access_token, I’m getting this error:

keycloak "error": "invalid_grant", "error_description": "Invalid refresh token"

I took a look at both decoded refresh_token JWTs (from Postman and from my C# code) and couldn’t find significant differences.

This is from Postman:

image
image586×722 31.6 KB

And this from my C# request:

image
image712×682 30.5 KB

I’m a bit confused and don’t quite see where the problem is coming from. Especially as the 1st request is going though…

2

“Invalid refresh token” sounds as you are re-using an alredy used token. As far as I know, the default in KC is that you can use a refresh token only once. And the System.Net.Http.HttpClient is intended to be instantiated once per application, rather than per-use:

1 Like
3

Revoke Refresh Token under realm settings is optional and by default disabled, unless not explicitly enabled.

4

Ah ok, sorry for the mix-up. I enabled it so long ago that i now consider it the default, especially because it is recommended for security reasons…

5

Revoke Refresh Token is currently disabled.

And the actual code uses the HttpClientFactory to create a HttpClient so that isn’t the issue either.

6

If the sequence of request works from postman but not from C# code, the issue must be in the C# code …
You obviously do not run the C# code from postman, you had to put it in a C# project and build it, so the problem must be somewhere in your C# code, and I think probably not related to Keycloak

7

Ensure that you pass the same scope in the refresh token request and probably check: