Exchange, refresh, check and revoke tokens

curl -s -u "${ACCOUNTS_APP_ID}:${ACCOUNTS_APP_SECRET}" "$ACCOUNTS_URL/v1/oauth/token" \
  -d grant_type=refresh_token -d "refresh_token=$REFRESH_TOKEN"

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGci…",
  "token_type": "Bearer",
  "expires_in": 1800,
  "refresh_token": "sar_5320RfvmiC21o0R_lANs…",
  "refresh_token_expires_at": "2029-03-25T02:56:36.117Z",
  "scope": "profile email openid",
  "id_token": "eyJ0eXAiOiJKV1QiLCJhbGci…",
  "membership_id": "briefcase:ptO",
  "account": { "uuid": "ptO", "id": "c:grace-hopper", "…": "…" }
}

curl -s -u "${ACCOUNTS_APP_ID}:${ACCOUNTS_APP_SECRET}" "$ACCOUNTS_URL/v1/oauth/token" \
  -d grant_type=authorization_code -d "code=$CODE" \
  -d redirect_uri=http://localhost:3000/callback -d "code_verifier=$CODE_VERIFIER"

curl -s -u "${ACCOUNTS_APP_ID}:${ACCOUNTS_APP_SECRET}" "$ACCOUNTS_URL/v1/oauth/token" \
  -d grant_type=urn:silicon:params:oauth:grant-type:slt -d "slt=$SLT"

silicon-accounts app token slt "$SLT"          # the same from the CLI, in app mode

//! A Silicon handed your app a short-lived token (`silicon-accounts login --app <app_id>` prints it).
//! Run: ACCOUNTS_APP_ID=briefcase ACCOUNTS_APP_SECRET=sa_app_… cargo run --bin slt -- slt_…
use silicon_accounts_client::Config;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let config = Config::from_env()?;
    let client = config.client()?;
    let app = config.app_client(&client).ok_or("set ACCOUNTS_APP_ID and ACCOUNTS_APP_SECRET")?;
    let slt = std::env::args().nth(1).ok_or("pass the slt_… token")?;

    match app.exchange_slt(&slt).await {
        Ok(tokens) => {
            let account = tokens.account.ok_or("token responses carry the account")?;
            // A Silicon has no email or phone; it always carries its custodian.
            println!("{} ({:?}) signed in, membership {}", account.id, account.kind, account.membership_id);
            if let Some(custodian) = account.custodian {
                println!("custodian: {} ({})", custodian.id, custodian.uuid);
            }
        }
        // Single use, 2 minutes, one app: a used, expired or another app's token is invalid_grant.
        Err(error) if error.is_code("invalid_grant") => eprintln!("refused: {error}"),
        Err(error) => return Err(error.into()),
    }
    Ok(())
}

si:scout (Silicon) signed in, membership briefcase:1Nx
custodian: c:grace-hopper (ptO)

refused: The short-lived token was already used; each one works once. Get a new one. Hint: Start a new sign-in. …

silicon-accounts app token refresh "$REFRESH_TOKEN" --json

let tokens = app.refresh(refresh_token).await?;   // store tokens.refresh_token right away

{"error": "invalid_grant", "error_description": "This refresh token was already used once. Presenting a used refresh token revokes the whole sign-in to protect the account, so this sign-in is now revoked; sign in again."}

{"error": "invalid_grant", "error_description": "The sign-in this refresh token belongs to was revoked at 2026-10-07T02:35:29.652Z (refresh_token_reuse); sign in again."}

// refresh.ts: one refresh per sign-in at a time. Two parallel refreshes with the same token
// count as reuse and end the sign-in, so callers that race share one request.
const ACCOUNTS_URL = process.env.ACCOUNTS_URL ?? "https://accounts.teamofsilicons.com";
const APP_ID = process.env.ACCOUNTS_APP_ID ?? "briefcase";
const APP_SECRET = process.env.ACCOUNTS_APP_SECRET ?? "";

type Tokens = { access_token: string; refresh_token: string; expires_in: number; scope: string };
const inFlight = new Map<string, Promise<Tokens>>(); // refresh token → the request using it

export function refreshTokens(refreshToken: string): Promise<Tokens> {
  let pending = inFlight.get(refreshToken);
  if (!pending) {
    pending = (async () => {
      const response = await fetch(new URL("/v1/oauth/token", ACCOUNTS_URL), {
        method: "POST",
        headers: {
          Authorization: `Basic ${Buffer.from(`${APP_ID}:${APP_SECRET}`).toString("base64")}`,
          "Content-Type": "application/x-www-form-urlencoded",
        },
        body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken }),
      });
      const body = await response.json();
      // invalid_grant: the sign-in ended (revoked, reused, access removed, 900 days): sign in again.
      if (!response.ok) throw Object.assign(new Error(body.error_description), { code: body.error });
      return body as Tokens; // store body.refresh_token now: the old one is spent
    })().finally(() => setTimeout(() => inFlight.delete(refreshToken), 60_000).unref());
    inFlight.set(refreshToken, pending);
  }
  return pending;
}

// Demo: three callers refresh at once; one request is made, all get the same new tokens.
const [a, b, c] = await Promise.all([1, 2, 3].map(() => refreshTokens(process.argv[2])));
console.log(a.refresh_token === b.refresh_token && b.refresh_token === c.refresh_token, a.scope);
console.log((await refreshTokens(a.refresh_token)).expires_in);

$ node refresh.ts sar_…
true profile email
1800

{"error": "invalid_scope", "error_description": "A refresh can't add scopes: 'phone' was not granted when the account signed in (granted: 'profile email openid'). Ask for more by sending the account through /authorize again."}

{
  "iss": "https://accounts.teamofsilicons.com",
  "sub": "ptO",
  "aud": "briefcase",
  "exp": 1791343596,
  "iat": 1791341796,
  "nbf": 1791341796,
  "jti": "01a1144a-9b1a-77ca-b0e4-fabbb9b6c3a5",
  "kind": "carbon",
  "id": "c:grace-hopper",
  "mid": "briefcase:ptO",
  "fid": "01a1144a-9b18-71e4-a5ab-14d69759855c",
  "scope": "profile email openid"
}

// verify.ts: check an access token locally (no call to Silicon Accounts per request).
import { createRemoteJWKSet, jwtVerify } from "jose";

const ACCOUNTS_URL = process.env.ACCOUNTS_URL ?? "https://accounts.teamofsilicons.com";
const APP_ID = process.env.ACCOUNTS_APP_ID ?? "briefcase";
// Fetched once, cached, refetched when a token names an unknown kid.
const jwks = createRemoteJWKSet(new URL("/.well-known/jwks.json", ACCOUNTS_URL));

export async function verifyAccessToken(token: string) {
  const { payload } = await jwtVerify(token, jwks, {
    issuer: ACCOUNTS_URL,       // the token's iss is the Silicon Accounts public URL
    audience: APP_ID,           // a token issued to another app is refused
    algorithms: ["EdDSA"],
  });
  // sub = account uuid, mid = membership id, kind = carbon | silicon, scope = granted scopes
  return payload as typeof payload & { sub: string; mid: string; kind: "carbon" | "silicon"; id: string; scope: string };
}

console.log(await verifyAccessToken(process.argv[2]));

valid: c:lin-docs (nln) for briefcase, expires 2026-10-07T03:08:37Z (in 29m)

curl -s -u "${ACCOUNTS_APP_ID}:${ACCOUNTS_APP_SECRET}" "$ACCOUNTS_URL/v1/oauth/introspect" -d "token=$ACCESS_TOKEN"

{
  "active": true,
  "aud": "briefcase",
  "client_id": "briefcase",
  "exp": 1791343603,
  "iat": 1791341803,
  "id": "c:grace-hopper",
  "iss": "https://accounts.teamofsilicons.com",
  "jti": "01a1144a-b941-7705-99bc-1f9792d04d22",
  "kind": "carbon",
  "membership_id": "briefcase:ptO",
  "nbf": 1791341803,
  "scope": "profile email openid",
  "sub": "ptO",
  "token_type": "access_token",
  "username": "c:grace-hopper"
}

curl -s "$ACCOUNTS_URL/v1/userinfo" -H "Authorization: Bearer $ACCESS_TOKEN"

{
  "display_name": "Grace Hopper",
  "email": "grace.hopper@example.com",
  "email_verified": true,
  "id": "c:grace-hopper",
  "kind": "carbon",
  "membership_id": "briefcase:ptO",
  "name": "Grace Hopper",
  "pfp_url": "https://iris.teamofsilicons.com/pfp/carbon?id=ptO",
  "picture": "https://iris.teamofsilicons.com/pfp/carbon?id=ptO",
  "sub": "ptO",
  "updated_at": "2026-10-07T02:56:29.875Z",
  "uuid": "ptO",
  "version": 1
}

curl -s -u "${ACCOUNTS_APP_ID}:${ACCOUNTS_APP_SECRET}" "$ACCOUNTS_URL/v1/oauth/revoke" -d "token=$REFRESH_TOKEN"
# {"revoked":true}