The session's tokens, as the identity provider issued them.
Both halves travel together because a host that has to trade this session for a
token of its OWN — an API that does not accept the IdP's access token directly,
and mints its own from a grant — needs the pair, not just the access token: the
grant identifies the session with accessToken and takes over renewing it with
refreshToken. Handing out only the access token forced such a host to read the
refresh token out of this library's storage behind its back.
The session's tokens, as the identity provider issued them.
Both halves travel together because a host that has to trade this session for a token of its OWN — an API that does not accept the IdP's access token directly, and mints its own from a grant — needs the pair, not just the access token: the grant identifies the session with
accessTokenand takes over renewing it withrefreshToken. Handing out only the access token forced such a host to read the refresh token out of this library's storage behind its back.