Where Could I find the refresh_token

Question

I found we need refresh token for renewing access token for REST API. But i couldn't find refresh token in response of my request. How can I get refresh token.Here is my code in PHP.

    $postData = array(
        'grant_type' => 'password',
        'client_id' => 'my_client_id',
        'client_secret' => 'my_client_secret',
        'username' => 'my_admin_username',
        'password' => 'my_admin_password+security token'
    );

    $token_url = 'https://cs57.salesforce.com/services/oauth2/token';

    $curl = curl_init();
    curl_setopt_array($curl, array(
        CURLOPT_HEADER => false,
        CURLOPT_URL => $token_url,
        CURLAUTH_ANY => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => $postData
    ));

    $json_response = curl_exec($curl);

    $status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
    $response = json_decode($json_response,true);
    print_r($response);
    curl_close($curl);

And the response I get is

Array ( [access_token] => my token 
        [instance_url] => https://cs57.salesforce.com 
        [id] => https://test.salesforce.com/id/00D0k0000000Xu2EAE/0057F000000q8KFQAY 
        [token_type] => Bearer 
        [issued_at] => 1503288742327 
        [signature] => wt/b1QFLd8EJmIx6Max8rW2xmovdj3q/onMdKfExAqo= 
)

As per the salesforce docs I should get refresh token also. But why I am not getting it. Or do I miss something here?

Update

It seems like, I asked a very dump question. I was following ' username-password authentication flow ' and the doc clearly says

" This OAuth authentication flow passes the user’s credentials back and forth. Use this authentication flow only when necessary. No refresh token is issued. "

Answer 1

This has always been the best guide to oAuth for me: https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com

Re refresh tokens, see this section: https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com#Token_Refresh

But yes, it depends on the type of flow you are using, and how the Connected App is configured. But a Web Server Flow or User Agent flow should return one.

Answer 2

Despite many hours of increasing desperation, I have never been able to find a way to get a refresh token from the initial authorization flow, as it is implied should happen by the above answer and others like it. The only thing that has worked for me is:

curl -v -L \
 -F 'response_type=token' \
 -F 'client_id=<consumer key of connected app>' \
 -F 'redirect_uri=https://login.salesforce.com/services/oauth2/success' \
 -F 'scope=refresh_token <any other scopes you need>' \
 -F 'prompt=consent' \
 https://login.salesforce.com/services/oauth2/authorize

This in my case delivers a 302 redirect response. Put the redirect URL returned into your browser, and it will take you to a Salesforce login followed by an oauth opt-in page. Click ok, and then your refresh token appears in the URI in the browser tab. It may be scrolled out of view so if you can't see it, scroll to the right.