diff --git a/docs/content/docs/authentication/github.mdx b/docs/content/docs/authentication/github.mdx index bcf7e0640f..c0a416044a 100644 --- a/docs/content/docs/authentication/github.mdx +++ b/docs/content/docs/authentication/github.mdx @@ -64,4 +64,11 @@ That's all! Now you can copy the Client ID and Client Secret of your app! If you get "email_not_found" error, it's because you selected a Github app & did not configure this part! - \ No newline at end of file + + +### Why don't I have a refresh token? + +Github doesn't issue refresh tokens for OAuth apps. For regular OAuth apps, +GitHub issues access tokens that remain valid indefinitely unless the user revokes them, +the app revokes them, or they go unused for a year. +There's no need for a refresh token because the access token doesn't expire on a short interval like Google or Discord. diff --git a/docs/content/docs/authentication/google.mdx b/docs/content/docs/authentication/google.mdx index d8ec0be8f6..c60020e6ba 100644 --- a/docs/content/docs/authentication/google.mdx +++ b/docs/content/docs/authentication/google.mdx @@ -107,3 +107,27 @@ This will trigger a new OAuth flow that requests the additional scopes. After co Ensure you're using Better Auth version 1.2.7 or later to avoid "Social account already linked" errors when requesting additional scopes from the same provider. + + +### Always get refresh token + +Google only issues a refresh token the first time a user consents to your app. +If the user has already authorized your app, subsequent OAuth flows will only return an access token, not a refresh token. + +To always get a refresh token, you can set the `accessType` to `offline`, and `prompt` to `select_account+consent` in the provider options. + +```ts +socialProviders: { + google: { + clientId: process.env.GOOGLE_CLIENT_ID as string, + clientSecret: process.env.GOOGLE_CLIENT_SECRET as string, + accessType: "offline", // [!code highlight] + prompt: "select_account+consent", // [!code highlight] + }, +} +``` + + + **Revoking Access:** If you want to get a new refresh token for a user who has already authorized your app, + you must have them revoke your app's access in their Google account settings, then re-authorize. + \ No newline at end of file