OAuth API doesn't send refresh token with custom redirect_uri

Question

If I put this link in my web browser (I put them on separate lines for readability):

https://login.salesforce.com/services/oauth2/authorize
?response_type=token
&client_id=MY_CONSUMER_KEY
&redirect_uri=https://login.salesforce.com/services/oauth2/success

and log in, it redirects me to the redirect_uri appended with a hash of all the important information I need. I want to use my own redirect_uri, so I modified the callback URL field for the application, and modified my request:

https://login.salesforce.com/services/oauth2/authorize
?response_type=token
&client_id=MY_CONSUMER_KEY
&redirect_uri=MY_CUSTOM_URI

I can log in like I would in the previous example, and it redirects me correctly to my custom uri, but without the refresh token in the hash. Any ideas?

Answer 1

According to the docs:

The refresh token for the user-agent flow is only issued under one of the following circumstances:

• The redirect URL uses a custom protocol.
• The redirect URL is exactly https://login.salesforce.com/services/oauth2/success, or on Sandbox, https://test.salesforce.com/services/oauth2/success.

User-agent flow is not intended for use with web apps (which is what it looks like you're trying to do). Use web server flow instead.