Google OAuth2 Refresh Token

Description

General

• Documentation: https://developers.google.com/identity/protocols/oauth2/web-server#offline
• Summary: A Google OAuth2 refresh token is issued to an application after a user authorizes it to access their Google account. With the application's client ID (and usually its client secret), the refresh token gets new access tokens for that user's account, without the user being present. It grants the scopes the user authorized, such as Google Cloud, Drive or Gmail access.

Each refresh token belongs to one user and one application. Refresh tokens do not expire by default: they stop working when the user revokes the access, after six months without use, or when an admin policy requires it.

The client ID and secret alone are covered by the Google OAuth2 Keys detector.

Details for Google OAuth2 Refresh Token

• Family: credentials

• Category: cloud_provider

• Company: Google

• High recall: False

• Validity check available: True

• Analyzer available: False

• Revoker available: True

• On-premise instances exist: False

• Only valid secrets raise an alert: False

• Occurrences found for one million commits: 6.51

• Prefixed: False

Revoker

Auth Credentials

Valid credentials needed to authenticate the request. No extra credentials needed for this revoker.

HTTP Calls

List of calls performed by the revoker.

• POST: /revoke

Revocation Mode

Revocation is synchronous.