I'm using Simple Oauth (4.x) in a headless application which is working well. However, I have noticed that when doing a post request that my access token is revoked, and the next post request will have to refresh the token before making another call. Is this the intended behaviour? I can't find anything in the documentation to suggest it is, but I assume it's there for some security reason.

If it is: how can I avoid it so that the access token doesn't need to be refreshed unless it has expired? In our application there is the possibility of multiple post requests happening in quick succession, which causes all sorts of problems and ends up with the user being logged out.

Other than dealing with it on the frontend (debounce etc.), is there anything I can do on the backend to make multiple post requests use the same access token without refreshing?


  • I'm using 5.2.0 and getting tokens revoked only after 403 requests. The logs show League\OAuth2\Server\Exception\OAuthServerException: The resource owner or authorization server denied the request. in League\OAuth2\Server\Exception\OAuthServerException::accessDenied() (line 243 of ~/vendor/league/oauth2-server/src/Exception/OAuthServerException.php).. Did you find any solution or source of the issue?
    – E.A.T
    Commented Feb 27, 2022 at 2:55


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.