refreshToken
Refreshes the token and returns a new credential snapshot.
Important: This credential instance becomes stale after a successful refresh. Always use the returned credential for subsequent operations:
val fresh = credential.refreshToken().getOrThrow()
fresh.getUserInfo() // correct — uses refreshed token
// credential.getUserInfo() // wrong — uses old expired tokenTo observe token updates reactively (e.g., in a UI), use getTokenFlow which emits every time the token is refreshed for this credential ID, regardless of which snapshot triggered the refresh.
Uses a shared orchestrator for deduplication — concurrent calls for the same credential ID will coalesce into a single network request.
Return
Result.success with a new Credential snapshot containing the refreshed token, or Result.failure with:
IllegalStateException if no refresh token is available on this credential.
Other exceptions if the refresh network request fails.
See also
for an overload that accepts additional request parameters.
Refreshes the token with additional form body parameters and returns a new credential snapshot.
The coalescing orchestrator used by refreshToken caches a single in-flight request per credential ID; it has no way to represent per-call parameters, so a request carrying extraRequestParameters can't share that cache. An implementation that supports non-empty parameters must therefore make its own network request for every call, bypassing the orchestrator.
Reserved keys (grant_type, client_id, refresh_token) are silently filtered out of extraRequestParameters and cannot be overridden.
This interface ships a default implementation with two behaviors, depending on extraRequestParameters:
Empty map: delegates to refreshToken — there's nothing extra to send, so this does go through the coalescing orchestrator, same as calling refreshToken directly.
Non-empty map: fails with NotImplementedError. The default implementation has no network logic of its own to forward extra parameters — implementations that need to support this must override the method; see CredentialImpl for the reference implementation that does.
Return
Result.success with a new Credential snapshot containing the refreshed token, or Result.failure with:
IllegalStateException if no refresh token is available on this credential.
NotImplementedError if extraRequestParameters is non-empty and this method has not been overridden with a real implementation.
Other exceptions if the refresh network request fails.
Parameters
additional form parameters to forward to the token endpoint (e.g., mapOf("acr_values" to "urn:okta:loa:2fa:any")).