RefressAcceshToken in SocialProvider (Microsoft) and NextJs 15

Hey, i am struggling to trigger the refreshAccesstoken for Microsoft.
Single Sign on works fine, i got an accesstoken and an accessTokenExpiresAt and a refreshtoken.

But how do i trigger to refresh the accesstoken automatically refreshed in when it is expired.
I thought, this is done automatically.

In need the accesstoken to be updated silently because i am calling some functionality on Azure and need it as bearer.

What is the best way to trigger / monitor this?

Many thanks for your help

Kind Regards
Sven

KiNFiSH•4/14/25, 4:43 AM

check refreshAccessToken fn here - https://www.better-auth.com/docs/concepts/oauth

OAuth | Better Auth

How Better Auth handles OAuth

KiNFiSH•4/14/25, 4:45 AM

like this -

Ssven09 Hey, i am struggling to trigger the refreshAccesstoken for Microsoft. Single Si...

Ping•4/14/25, 5:14 PM

@bekacru the should trigger automatically when access token expires, right?

Syntarex•4/14/25, 5:20 PM

Hi Sven! I'm curious on how you got the Microsoft AccessToken. Im trying to get it too so I can call Graph on User behalf.

sven09OP•4/14/25, 6:35 PM

I have solved it and will post it tomorrow as soon as i am back to my Computer

PPing @bekacru the `refreshAccessToken` should trigger automatically when access token...

Syntarex•4/14/25, 6:38 PM

Ah that would be awesome.

PPing @bekacru the `refreshAccessToken` should trigger automatically when access token...

KiNFiSH•4/14/25, 7:46 PM

The user might not want to refresh the token just because it has expired. There could be scenarios where token refreshing needs to be handled on a based on some condition, but by default, it can be set to refresh upon expiry.

sven09OP•4/15/25, 9:20 AM

I managed to do this all on nextjs / prisma / hono project. Here are the pieces.

sven09OP•4/15/25, 9:30 AM

sven09OP•4/15/25, 9:33 AM

in your social provider

sven09OP•4/15/25, 9:34 AM

i can post here anymore...

sven09OP•4/15/25, 9:36 AM

code.txt1.54KB

sven09OP•4/15/25, 9:37 AM

make sure that you have offline_access in your token config and scope

Syntarex•4/15/25, 12:32 PM

Ah that makes sense! Thanks!

sven09OP•4/15/25, 3:10 PM

5 hours of research (aka tears):

if you put in user.read in the scope the token will be issued for msgraph (The reason your access token’s aud (audience) claim is set to "00000003-0000-0000-c000-000000000000" is because this GUID represents the Microsoft Graph API.)

and add your api to the scope api://<your-client-id>/access_as_user

now i can get an accesstoken in nextjs for an app registration and call a azure resource with the accesstoken as bearer

KKiNFiSH The user might not want to refresh the token just because it has expired. There ...

sven09OP•4/15/25, 7:39 PM

How can it be configured?

Ssven09 5 hours of research (aka tears): if you put in user.read in the scope the token...

bekacru•4/15/25, 7:43 PM

I think we should provide helper that refresh the token automatically, if it's expired. It shouldn't require this much work.