Support changes to refresh tokens

Reddit is changing how refresh tokens are handled. In a nutshell, refresh tokens will be usable only once: https://old.reddit.com/r/redditdev/comments/kvzaot/oauth2_api_changes_upcoming/

As a result, we need to consider how best to handle dynamic refresh tokens.

Here’s what I propose:

1. Remove support for refresh_token in both praw.ini and as a keyword argument to praw.Reddit.

Since the refresh tokens will be dynamic, it doesn’t make sense to keep them in a config file. And since we’ll need a way to allow people to manually update the refresh token on an existing instance, I don’t think we should support two distinct ways to provide a refresh token to a Reddit instance.

1. Provide a method to set the refresh token (and optionally the access token) on a Reddit instance. For example, reddit.auth.set_token(...).

2. Provide a way to register a callback function that is called whenever the refresh token, and the access token is changed. In this way users can save and synchronize these tokens however they please, e.g., via a file, a database, etc. I propose we call this: reddit.auth.token_change_callback(function).

These ideas stemmed from this part of the discussion: https://old.reddit.com/r/redditdev/comments/kvzaot/oauth2_api_changes_upcoming/gj2xcsx/

[bboe]

the vast majority of individual users that use PRAW for scripts, bots, etc are likely going to pass it only once at initialization, it would be convenient and naively intuitive to do so as a parameter to the constructor, like everything else.

I think many users might be using the same credentials for multiple distinct scripts, so they likely will need a way to dynamically set the refresh token (or access token) when a new one is available. Additionally, I think having a separate method makes it clear that this attribute frequently changes and can no longer be set it and forget it.

just pass the client_id and client_secret (as parameters, from praw.ini, etc, and then call set_token(…) before actually using it

Yes, that’s what I’m thinking.

And presumably, until the token is set, the instance wouldn’t be authorized yet? Also, would this trigger the callback (I’d hope not), or just it changing after a request?

Correct. Fetching the token will only happen as needed, i.e., on request.

One thing though—is this planned to be implemented by the time the Reddit API changes go live and consumed refresh tokens will no longer work?

I’m planning to implement this feature this week.

[bboe]

No worries. I like to move quick sometime. We can always adapt if there are use cases we didn’t consider.