Problems with refresh token flow in Microsoft Entra ID

[hugocruzlfc]

Hi team,

I am trying to implement refresh token flow for authentication with Microsoft Entra ID in my application, following the code and guidelines provided in this repository. However, I am facing several issues and would like help or clarifications.

My code attempts to refresh the access token using a refresh_token like this:

import NextAuth from "next-auth";
import MicrosoftEntraID from "next-auth/providers/microsoft-entra-id";
import { env } from "./env";
import { ROUTES } from "./lib/constants";
import kyInstance from "./lib/ky-instance";

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    MicrosoftEntraID({
      clientId: env.AUTH_MICROSOFT_ENTRA_ID_ID,
      clientSecret: env.AUTH_MICROSOFT_ENTRA_ID_SECRET,
      issuer: env.AUTH_MICROSOFT_ENTRA_ID_ISSUER,
      authorization: {
        params: {
          scope: "openid profile email offline_access",
        },
      },
    }),
  ],
  pages: {
    signIn: ROUTES.LOGIN,
  },
  callbacks: {
    async jwt({ token, user, account }) {
      if (user) {
        token.id = user.id;
        token.email = user.email;
      }

      if (account) {
        try {
          const [, payload] = account?.id_token?.split(".") || [];
          const idToken = JSON.parse(
            Buffer.from(payload, "base64").toString("utf8"),
          );

          token.roles = idToken.roles ? [...idToken.roles] : [];

          return {
            ...token,
            access_token: account.access_token,
            expires_at: account.expires_at,
            refresh_token: account.refresh_token,
          };
        } catch (error) {
          console.error("Error decoding id_token:", error);
          token.roles = [];
          return token;
        }
      } else if (Date.now() < (token.expires_at as number) * 1000) {
        return token;
      } else {
        if (!token.refresh_token) throw new TypeError("Missing refresh_token");

        try {
          const response = await kyInstance
            .post(`${env.AUTH_MICROSOFT_ENTRA_ID_ISSUER}/token`, {
              body: new URLSearchParams({
                client_id: env.AUTH_MICROSOFT_ENTRA_ID_ID,
                client_secret: env.AUTH_MICROSOFT_ENTRA_ID_SECRET,
                grant_type: "refresh_token",
                refresh_token: token.refresh_token as string,
              }),
            })
            .json<{
              access_token: string;
              expires_in: number;
              refresh_token?: string;
            }>();

          if (!response) throw response;

          return {
            ...token,
            access_token: response.access_token,
            expires_at: Math.floor(Date.now() / 1000 + response.expires_in),
            refresh_token: response.refresh_token
              ? response.refresh_token
              : token.refresh_token,
          };
        } catch (error) {
          console.error("Error refreshing access_token", error);
          token.error = "RefreshTokenError";
          return token;
        }
      }
    },
    session({ session, token }) {
      if (session.user) {
        session.user.id = token.id as string;
        session.user.roles = token.roles as string[];
        session.user.email = token.email as string;
        session.error = token.error as "RefreshTokenError";
        session.access_token = token.access_token as string;
      }

      return session;
    },
  },
});


declare module "next-auth" {
  interface Session {
    user: {
      id: string;
      roles: string[];
      email: string;
    } & DefaultSession["user"];
    error?: "RefreshTokenError";
    access_token?: string;
  }
}

declare module "next-auth/jwt" {
  interface JWT {
    access_token: string;
    expires_at: number;
    refresh_token?: string;
    error?: "RefreshTokenError";
  }
}

Context

• Current date and time: 03:23 PM CEST, Tuesday, May 27, 2025.
• I use the ky library for HTTP requests.
• The application is registered with Microsoft Entra ID with basic permissions (e.g. openid, profile).
• At the moment everything works correctly, except the refresh token, because after 90 minutes the token that I am sending to my backend, and that I check with Entry ID, tells me that it is expired.

Request for assistance

Would a guide to implement this be possible? It is not clear how to configure all this in the official documentation. I don't know if some kind of permission or something like that is missing.

Thank you in advance for your support.