My OAuth Refresh Isn't Working 😕🙏

Custom Apps
1

Hey everyone! :waving_hand:

I’m running into a bit of trouble with my custom OAuth2 flow for Google on Make and could really use some friendly advice. My token refresh step never seems to fire, so my token never updates when it expires. I’ve set up the authorize, token, refresh, info, and invalidate steps as shown below.

Here’s the JSON code I’m using:

{
  "authorize": {
    "url": "https://accounts.google.com/o/oauth2/v2/auth",
    "qs": {
      "scope": "{{join(oauth.scope, ' ')}}",
      "client_id": "{{common.clientId}}",
      "redirect_uri": "{{oauth.localRedirectUri}}",
      "response_type": "code",
      "access_type": "offline",
      "prompt": "consent"
    },
    "response": {
      "temp": {
        "code": "{{query.code}}"
      }
    }
  },
  "token": {
    "condition": "{{temp.code}}",
    "url": "https://oauth2.googleapis.com/token",
    "method": "POST",
    "body": {
      "code": "{{temp.code}}",
      "client_id": "{{common.clientId}}",
      "client_secret": "{{common.clientSecret}}",
      "grant_type": "authorization_code",
      "redirect_uri": "{{oauth.localRedirectUri}}"
    },
    "type": "urlencoded",
    "response": {
      "data": {
        "expires": "{{addSeconds(now, body.expires_in)}}",
        "accessToken": "{{body.access_token}}",
        "refreshToken": "{{body.refresh_token}}",
        "idToken": "{{body.id_token}}"
      }
    },
    "log": {
      "sanitize": [
        "request.body.client_secret",
        "response.body.access_token",
        "response.body.refresh_token",
        "response.body.id_token"
      ]
    }
  },
  "refresh": {
    "condition": "{{data.expires < addMinutes(now, 59)}}",
    "url": "https://oauth2.googleapis.com/token",
    "method": "POST",
    "body": {
      "client_id": "{{ifempty(parameters.clientId, common.clientId)}}",
      "grant_type": "refresh_token",
      "client_secret": "{{ifempty(parameters.clientSecret, common.clientSecret)}}",
      "refresh_token": "{{data.refreshToken}}"
    },
    "type": "urlencoded",
    "response": {
      "data": {
        "expires": "{{addSeconds(now, body.expires_in)}}",
        "accessToken": "{{body.access_token}}",
        "refreshToken": "{{body.refresh_token ? body.refresh_token : data.refreshToken}}"
      },
      "expires": "{{addSeconds(now, body.refresh_expires_in)}}"
    },
    "log": {
      "sanitize": [
        "request.body.client_secret",
        "request.body.refresh_token",
        "response.body.access_token",
        "response.body.refresh_token"
      ]
    }
  },
  "info": {
    "url": "{{common.supabaseUrl}}/auth/v1/token",
    "method": "POST",
    "headers": {
      "apikey": "{{common.supabaseAnonKey}}",
      "Content-Type": "application/json"
    },
    "body": {
      "provider": "google",
      "id_token": "{{data.idToken}}"
    },
    "qs": {
      "grant_type": "id_token"
    },
    "response": {
      "data": {
        "supabaseAccessToken": "{{body.access_token}}",
        "supabaseRefreshToken": "{{body.refresh_token}}",
        "user_id": "{{body.user.id}}"
      }
    }
  },
  "invalidate": {
    "url": "https://accounts.google.com/o/oauth2/revoke",
    "qs": {
      "token": "{{connection.accessToken}}"
    },
    "log": {
      "sanitize": [
        "request.qs.token"
      ]
    }
  }
}

I notice that the refresh condition is set as "{{data.expires < addMinutes(now, 59)}}", but it never triggers. A couple of questions I’m hoping you all might help me with:

  • Is my refresh condition correct? :thinking:
  • Could it be that Google’s response sometimes doesn’t include the refresh_expires_in field, causing issues?
  • Are there any best practices or debugging tips for handling the refresh step in this setup?

Thanks a bunch for your help and insights! Looking forward to your suggestions. :blush::sparkles:

Cheers!