Consider the following scenario:
- I have an Oauth 2 app configured to ask permission for scopes A and B;
- Clients give me permission, and I store their refresh tokens securely.
If I change the scope this app asks to ask A, B, and C, will the refresh tokens that I have stored before the change remain valid?
I expect originally generated refresh tokens to remain valid.
New contributor
Marcelo Dias is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.