Are access tokens tied to refresh tokens, such that renewing an inactive but not yet expired access token can only be done by its original refresh token, the one used to create it?
2 Answers
Your close.
When a user grants an application consent. The application is identified by an client id and a client secrete (this depends a little on the type of application but lets just go with this for an example)
When the user consents an access token is created and sometimes a refresh token. (actually there is another step in this exchange but not related to this question see: authorization code)
Access tokens are self contained they will work for the length of their expiration within the authorization server. most common is an hour. Access tokens dont go inactive they will work for that hour.
If a refresh token is used in combination with the client id and client secret then a new access token is created. This access token will also work for an hour.
There is no limit to the number of access tokens that a refresh token can create and they will all work until they have expired.
I have a YouTube video that you may find interesting understanding oauth2 with curl
According to RFC-6749
The refresh token is used to generate new Access Token
Refresh tokens are credentials used to obtain access tokens. Refresh tokens are issued to the client by the authorization server and are used to obtain a new access token when the current access token becomes invalid or expires, or to obtain additional access tokens with identical or narrower scope
According to the RFC, the Refresh Token's purpose is to generate new Access Token rather than renewing an inactive token.
Especially in the case of Stateless Tokens where all the required information are self containing
Related