I am now using web server authentication flow along with refresh token flow in my system. Once a user granted a permission for the app to access, the app will request a permission, an access token and refresh token. Web server authentication would be required only once. Both acquired tokens would be stored and the access token would be refreshed if expired.
Is this a good practice? Should web server authentication flow always be used with refresh token flow? When should we use refresh token to get the access token anew?
Is it acceptable to just use web server authentication flow every time to get a new authentication code and a new access token? Because the user logs in process seems to be skipped if the user has already granted the permission to the app.
Any guidance would be much appreciated!