Ability to Downgrade Scopes and Audience on Refresh Token Grant in Auth0

Auth0 supports passing audience and scope parameters during a refresh token exchange flow to narrow the permissions granted. While Auth0 cannot elevate scopes and audiences beyond the original grant, Auth0 does allow downgrading them by passing these parameters in the payload. This capability allows us to restrict access token permissions when granting a refresh token.

• Auth0
• Refresh Token Grant
• Scopes
• Audience

How are scopes and audiences downgraded during a refresh token grant?

Auth0 supports passing audience and scope parameters during a refresh token exchange and cannot elevate scopes and audiences beyond the original grant, but it can narrow them.

• Original access token audience claim array: ["<your_custom_API_identifier>", "https://<your_domain>/userinfo"]
• Original scopes: "openid offline_access profile email"

For example, execute the following curl command to pass the downgraded scope and audience parameters during the refresh token exchange.

curl --request POST \
--url 'https://<your_domain>/oauth/token' \
--header 'content-type: application/x-www-form-urlencoded' \
--data grant_type=refresh_token \
--data 'client_id=<your_client_id>' \
--data 'refresh_token=<your_refresh_token>' \
--data 'scope=openid offline_access' \
--data 'audience=<your_custom_API_identifier>'

• Downgraded audience claim: ["<your_custom_API_identifier>"]
• Downgraded scopes: "openid offline_access"