We are currently trying to refactor code that is using AzureAuth to use httr2 for Azure Active Directory authentication (device code) with OAuth flow. In our case, we need access tokens for multiple scopes but we only want the user to authenticate once. We also want to cache the tokens.

AzureAuth does this by using a refresh token for one scope to obtain an access token for another scope.

We have tried to replicate this approach using httr2::oauth_flow_refresh() (redacted):

scope_client <- paste0("XYZ", "/.default offline_access")
scope <- "https://graph.microsoft.com/.default offline_access"
oauth_client <- httr2::oauth_client(
  id = "XYZ",
  token_url = "https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token"
)
token_app <- httr2::oauth_token_cached(
  client = oauth_client,
  flow = httr2::oauth_flow_device,
  flow_params = list(
    auth_url = "https://login.microsoftonline.com/{tenant}/oauth2/v2.0/devicecode",
    scope = scope_client
  ),
  cache_disk = TRUE,
  cache_key = rlang::hash(scope_client)
)
token <- httr2::oauth_token_cached(
  client = oauth_client,
  flow = httr2::oauth_flow_refresh,
  flow_params = list(
    refresh_token = token_app$refresh_token,
    scope = scope
  ),
  cache_disk = TRUE,
  cache_key = rlang::hash(scope)
)

However, we get warnings from httr2::oauth_flow_refresh() because the server returns a new refresh token. In addition, the docu to httr2::oauth_flow_refresh() states that this function is primarily intended for testing. All in all it feels like there should be a better solution. We would prefer something using one of the req_oauth_*() functions to directly authorize our requests and leave the token management to httr2, but we can’t get it to work.