Hello,
We’re currently facing an issue with the refresh token mechanism.
We retrieve the token during the post-processing step of the Authentication Service.
In other parts of the application, we call REST services using the same token that was previously stored during authentication. When the token expires, the REST call fails (which is expected).
We would like to implement a token refresh mechanism. We tried using an Authentication Profile, which we call directly from the REST connectors.
Here is our configuration:
However, we have’nt been able to retrieve the new token. We always get the old one instead.
Do you have any idea why this is happening, or how we could resolve this issue ?
My understanding was that the Authentication Profile should address this use case. Is that correct ?
The Pega OAuth 2.0 Authentication Profile supports automatic token refresh, but it must manage the token itself. The token stored during Authentication Service post-processing is separate and will not automatically refresh. Configure the Authentication Profile with the correct OAuth provider, grant type, client credentials, and token endpoint. Ensure the external authorization server returns a valid refresh token and token expiration details. Enable the Use refresh token if available checkbox, as shown in your configuration. Assign this Authentication Profile directly to the Connect-REST rules calling the external services. Remove manually configured Authorization headers that reuse the previously stored access token. When the access token expires, Pega can use the refresh token to obtain a new access token automatically. Finally, verify the refresh request and new token response using Pega logs and Tracer
The Authentication Profile only refreshes the token it manages itself, not the one you stored during the Authentication Service post-processing, so reading your stored value will always return the old token. I suggest letting the REST connectors rely only on the profile. Please also check that a refresh token is actually issued, as your Scope looks empty and may need value like offline_access. Check with provider.
