github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-28 09:56:25 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

docs: add info about refresh tokens for Google & Github (#3305)

Browse Source
This commit is contained in:
Maxwell
2025-07-09 01:32:45 +10:00
committed by GitHub
parent c483fa14db
commit e1579dc5d1
2 changed files with 32 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/content/docs/authentication/github.mdx
View File

@@ -64,4 +64,11 @@ That's all! Now you can copy the Client ID and Client Secret of your app!
<Callout>
If you get "email_not_found" error, it's because you selected a Github app & did not configure this part!
</Callout>
</Callout>
### Why don't I have a refresh token?
Github doesn't issue refresh tokens for OAuth apps. For regular OAuth apps,
GitHub issues access tokens that remain valid indefinitely unless the user revokes them,
the app revokes them, or they go unused for a year.
There's no need for a refresh token because the access token doesn't expire on a short interval like Google or Discord.

24
docs/content/docs/authentication/google.mdx
View File

@@ -107,3 +107,27 @@ This will trigger a new OAuth flow that requests the additional scopes. After co
<Callout>
Ensure you're using Better Auth version 1.2.7 or later to avoid "Social account already linked" errors when requesting additional scopes from the same provider.
</Callout>
### Always get refresh token
Google only issues a refresh token the first time a user consents to your app.
If the user has already authorized your app, subsequent OAuth flows will only return an access token, not a refresh token.
To always get a refresh token, you can set the `accessType` to `offline`, and `prompt` to `select_account+consent` in the provider options.
```ts
socialProviders: {
google: {
clientId: process.env.GOOGLE_CLIENT_ID as string,
clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
accessType: "offline", // [!code highlight]
prompt: "select_account+consent", // [!code highlight]
},
}
```
<Callout>
**Revoking Access:** If you want to get a new refresh token for a user who has already authorized your app,
you must have them revoke your app's access in their Google account settings, then re-authorize.
</Callout>