We are using OpenID Connect (OIDC) via an Authentication Service integrated with Okta as our Identity Provider (IdP).
The Access Token generated by Okta has a specific validity window.
If a user keeps an old Pega session open past this window, subsequent calls made from Pega to external APIs fail because the current Access Token has expired.
To resolve this, we are trying to implement a token refresh strategy within our Post-Authentication Activity using Pega Engine APIs.
While we are successfully able to initialize com.pega.pegarules.pub.connect.oauth2.OAuth2Client and retrieve the access token via oauth2Client.getAccessToken(), But compiling our custom Java step fails because no public Java method exists to retrieve the Refresh Token.
Try to use OOTB pxRevokeToken activity with Authentication profile as parameter in post authentication activity. In new API call , fresh token can be generated.
To resolve the compilation failure and handle the expired token, you must avoid manual Java steps to extract the refresh token, as Pega deliberately encrypts and hides it from public APIs for security purposes. Instead, the solution is to configure an OAuth 2.0 Authentication Profile directly on your Connect-REST rule using the Authorization Code grant type and enable the “Use refresh token if available” checkbox. This allows the Pega Platform to automatically intercept expired access tokens at runtime, fetch the corresponding encrypted refresh token from the internal database (pr_data_token), and silently request a fresh access token from Okta without requiring any custom Java code.
When a user logs in to the application using OIDC, the Identity Provider (IdP) issues an ID Token, Access Token, and optionally a Refresh Token.
Pega creates a unique cache key based on the combination of Client ID , Scopes , User and Grant Type and stores the issued tokens against that key.
Later, when an outbound call is made using the same Client ID and Scopes, Pega first looks up the cache (or database) using the generated key.
If a matching entry is found, Pega fetches the associated access token and
If the access token is still valid, it is reused for the outbound call.
If the access token has expired, Pega checks for a valid refresh token and uses it to obtain a new access token from the IdP.
Important Note :
To enable automatic token renewal, the “Use refresh token if available” option must be enabled in the Authentication Profile
Make sure the order of scopes provided must match between Authentication service and Authentication Profile .
This entire process is handled automatically by Pega behind the scenes and does not require any custom implementation.