Which OAuth mechanism enables clients to continue to have an active access token without further interaction from the user?

The OAuth 2.0 Refresh Token grant, often referred to as a "refresh grant," is the mechanism designed for this purpose. When a client initially receives an access token, it can also be issued a long-lived refresh token. Once the short-lived access token expires, the client can present the refresh token to the authorization server to obtain a new access token. This entire process happens on the back channel between the client and the server, without requiring the user to re-authenticate or provide their credentials again, thus enabling continued access.

A. JWT (JSON Web Token) is a standard for creating access tokens themselves (a token format), not a grant type or a mechanism for renewing them.

B. The password grant is a grant type used for the initial acquisition of an access token by exchanging the user's credentials, not for renewing it without user interaction.

D. A preshared key is a generic cryptographic concept for symmetric authentication or encryption and is not a specific grant type or mechanism within the OAuth 2.0 framework.

---

1. Internet Engineering Task Force (IETF) RFC 6749

"The OAuth 2.0 Authorization Framework":

Section 1.5

"Refresh Token": "Refresh tokens are used to obtain a new access token... This allows clients to continue to have a valid access token without further interaction with the user."

Section 6

"Refreshing an Access Token": This section explicitly defines the flow where the client uses a granttype of refreshtoken to request a new access token from the authorization server.

2. Cisco DevNet Documentation

"Webex for Developers - OAuth 2.0":

Section "Refreshing Access Tokens": "When your access token expires

you'll need to use your refresh token to get a new one... To refresh an access token

make a POST request to the access token URL with a granttype of refreshtoken." This official vendor documentation confirms the use of the refresh token grant.

3. Okta Developer Documentation

"OAuth 2.0 and OpenID Connect Overview":

Section "Refresh token": "The refresh token allows an application to get a new access token without prompting the user." This is another official vendor source that aligns with the core standard.