is access_token always not expired inside profile()?

[stardvst]

i'm using access_token from tokens inside the profile() callback:

 profile(profile, tokens) {
        const { access_token, refresh_token, token_type } = tokens;
        // make api request with access_token

i'm wondering if i can rely on access_token being always valid and not worry about its expiration?
or i have to look at response status code and refresh the token with refresh_token?

 if (data.error.status === 401) {
       // get new access token from refresh_token

[balazsorban44]

there is currently no built-in token rotation,so you will have to implement it yourself.

you can check out https://next-auth.js.org/tutorials/refresh-token-rotation

[stardvst]

it looks there isn't: https://next-auth.js.org/configuration/callbacks#jwt-callback

This method is not invoked when you persist sessions in a database.

previously, i had implemented token rotation, and called the method inside getServerSideProps() (where i need to made api request with the token). is that wrong to do?

[balazsorban44]

as this isn't built-in yet, I don't want to give bad suggestions. I haven't looked into the problem much yet, so I cannot answer what's good and what's not. you will have to read the docs. the jwt callback is probably not the only right place for token rotation.

[stardvst]

okay, i will keep the old implementation for now inside the application.
but can you please confirm that inside profile(profile, tokens) { ... }, tokens.access_token may be expired?
it seems to me that when profile() is called, access token will never be expired, as the call implies retrieving new access/refresh tokens for the profile: https://next-auth.js.org/configuration/providers/oauth#options

[balazsorban44]

the profile callback is called when you are signing in with a user, so no, the access token will always be new, but the one that is saved in the database can expire, since we only create the account once

[stardvst]

okay thanks. i take care of updating access token in the database inside the application.
so when user signs in again while the access token is expired in the database, since i'm retrieving access token from db (to make requests), the code will detect expiration and get new access token and also update it in the db.