Need clear the refresh token workflow.

I want to store the tokens in my database and before call google apis, I want use refresh_token to get a new access_token so that user don’t need redirect to the consent screen.

Here is my workflow:

router.get('/oauth/callback', async (req, res) => {
  const { code: authorizationCode } = req.query;
  const { tokens } = await oauth2Client.getToken(authorizationCode);
  oauth2Client.setCredentials(tokens);
 
   // store tokens in database
  db.save(tokens);
 
   //...
});

And, before every google api call, I will set refresh_token to oauth2Client like this:

router.get('/plus/:userId', () => {
  //get refresh token from database
  db.get(tokens);

  oauth2client.setCredentials({ refresh_token: tokens.refresh_token });

  // call google+ api
  const plus = google.plus("v1");
  const { data } = await plus.people.get({ userId });

  //...
})

1. Is the workflow correct?
2. Is it necessary to set refresh_token before every api call?
3. Should I check the expired time of access_token by myself?
4. refreshAccessToken is deprecated. Is that mean I don’t need refresh access_token by myself?

Need clear the doc.

[mrdulin]

@AVaksman Thanks for reply.

The readme says:

This library will automatically use a refresh token to obtain a new access token if it is about to expire.

I think the refresh token should be attached to a user context. Which means each user will have a refresh token. Which refresh token the library will automatically use? So I think I should set the refresh token to this library manually. Like below:

const refreshToken = db.findRefreshTokenByUserId(1);
oauth2Client.setCredentials({refresh_token: refreshToken});

The tokens event does not have a user context. I think what @supertiger1234 said is the same thing.

I use express.js, in order to get the user context of client request, which place should I put this token event? The middleware or some global scope?

If there is an sample using express.js for handling the expiring of access token. That will be great.

After I read readme about ten times. I think maybe setCredentials api can satisfy my requirement.

Here is fake code to demonstrate the workflow:

router.use(function authMiddeware (req, res, next) { 
  const {userId} = jwt.verify(token, 'secret');
  const STORED_REFRESH_TOKEN = db.findRefreshTokenByUserId(userId);
  oauth2client.setCredentials({
    refresh_token: STORED_REFRESH_TOKEN
  });
  next();
})

[bcoe]

@apoorva-shah a refresh token does not expire (or should expire very rarely, e.g., if a user revokes credentials on their account). If the goal is to perform background processing for a user with your application, store the refresh_token when first authorizing, and then use this when instantiating the client in the future (the auth library will handle refreshing the token automatically).