refreshToken

abstract suspend fun refreshToken(): ERROR CLASS: Symbol not found for Result<com/okta/authfoundation/credential/kmp/Credential>

Refreshes the token and returns a new credential snapshot.

Important: This credential instance becomes stale after a successful refresh. Always use the returned credential for subsequent operations:

val fresh = credential.refreshToken().getOrThrow()
fresh.getUserInfo() // correct — uses refreshed token
// credential.getUserInfo() // wrong — uses old expired token

To observe token updates reactively (e.g., in a UI), use getTokenFlow which emits every time the token is refreshed for this credential ID, regardless of which snapshot triggered the refresh.

Uses a shared orchestrator for deduplication — concurrent calls for the same credential ID will coalesce into a single network request.

Return

Result.success with a new Credential snapshot containing the refreshed token, or Result.failure with:

  • IllegalStateException if no refresh token is available on this credential.

  • Other exceptions if the refresh network request fails.

See also

for an overload that accepts additional request parameters.


open suspend fun refreshToken(extraRequestParameters: Map<String, String>): ERROR CLASS: Symbol not found for Result<com/okta/authfoundation/credential/kmp/Credential>

Refreshes the token with additional form body parameters and returns a new credential snapshot.

The coalescing orchestrator used by refreshToken caches a single in-flight request per credential ID; it has no way to represent per-call parameters, so a request carrying extraRequestParameters can't share that cache. An implementation that supports non-empty parameters must therefore make its own network request for every call, bypassing the orchestrator.

Reserved keys (grant_type, client_id, refresh_token) are silently filtered out of extraRequestParameters and cannot be overridden.

This interface ships a default implementation with two behaviors, depending on extraRequestParameters:

  • Empty map: delegates to refreshToken — there's nothing extra to send, so this does go through the coalescing orchestrator, same as calling refreshToken directly.

  • Non-empty map: fails with NotImplementedError. The default implementation has no network logic of its own to forward extra parameters — implementations that need to support this must override the method; see CredentialImpl for the reference implementation that does.

Return

Result.success with a new Credential snapshot containing the refreshed token, or Result.failure with:

  • IllegalStateException if no refresh token is available on this credential.

  • NotImplementedError if extraRequestParameters is non-empty and this method has not been overridden with a real implementation.

  • Other exceptions if the refresh network request fails.

Parameters

extraRequestParameters

additional form parameters to forward to the token endpoint (e.g., mapOf("acr_values" to "urn:okta:loa:2fa:any")).