This message was deleted.

Refresh Token Compatibility Analysis Your analysis is correct — Descope refresh tokens from the Auth API (

selectTenant

) should work with the OAuth2 token endpoint, but this needs verification. Descope's Token Architecture Descope implements refresh token rotation as part of the OAuth 2.0 flow . When a refresh token is used to obtain a new access token, Descope issues a new refresh token along with the new access token, and the old refresh token is immediately invalidated . Two Refresh Paths Available 1. Auth API Path:

/api/session/refresh-session

endpoint that accepts refresh tokens via Authorization Bearer header format:

Authorization: Bearer <Project ID:Refresh JWT>

2. OAuth2 Token Path:

/oauth2/v1/apps/token

endpoint that accepts

grant_type=refresh_token

in the request body Recommended Approach For guaranteed MDM session renewal, implement both paths:

// Primary: OAuth2 refresh (your current approach)
match oauth::refresh_access_token(DESCOPE_PROJECT_ID, &refresh_token) {
    Ok(tokens) => tokens,
    Err(_) => {
        // Fallback: Auth API refresh
        descope_auth_api_refresh(DESCOPE_PROJECT_ID, &refresh_token)?
    }
}

The SDK

refresh

function uses the Auth API endpoint , providing a reliable fallback if OAuth2 compatibility varies. Refresh Token Rotation | Descope Documentation Token Validation Key (V2) | API Reference | Descope Documentation Third Party application token endpoint | API Reference | Descope Documentation Auth Helpers Overview | Client SDK | Descope Documentation

p;lease human answer