Skip to content

OAuth: Automatically Refresh Token on Expiry#76

Merged
n7studios merged 6 commits intomainfrom
automatically-refresh-token
Jul 9, 2025
Merged

OAuth: Automatically Refresh Token on Expiry#76
n7studios merged 6 commits intomainfrom
automatically-refresh-token

Conversation

@n7studios
Copy link
Contributor

Summary

Reduces the likelihood of 401 unauthorized requests being sent to the Kit API by scheduling a WordPress cron event to refresh an expired access token on its expiry.

Presently, the Plugin relies on logic to check if an API request returns a 401 error with the message The access token expired. On lower traffic sites - for example, where there are not many customers subscribing or purchases being sent to Kit - this isn't a reliable method, as a call to the API won't always be triggered.

Testing

  • testCronEventCreatedWhenAccessTokenObtained: Test that the convertkit_refresh_token event is scheduled when OAuth first completes and the Plugin receives access and refresh tokens.
  • testCronEventCreatedWhenTokenRefreshed: Test that the convertkit_refresh_token event is scheduled when the access token is refreshed.

Checklist

@n7studios n7studios self-assigned this Jun 26, 2025
'EndToEnd/member-update',
'EndToEnd/product'
'EndToEnd/product',
'Integration'
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Integration tests weren't running on GitHub actions; this ensures they run.

@n7studios n7studios requested review from a team, corydhmiller and noelherrick and removed request for a team June 28, 2025 02:18
@n7studios n7studios marked this pull request as ready for review June 28, 2025 02:18
@n7studios n7studios requested a review from a team June 28, 2025 05:30
'access_token' => $result['access_token'],
'refresh_token' => $result['refresh_token'],
'token_expires' => ( $result['created_at'] + $result['expires_in'] ),
'token_expires' => ( time() + $result['expires_in'] ),

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are you switching to this? Wouldn't this set the expiration to longer than it actually is?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

expires_in is the number of seconds before the access token expires, not a timestamp of when the access token expires, and the API has never returned a fixed value. Adding it to created_at results in the exact issue reported in this PR. Adding it to time() results in the correct calculation of the token's expiry. But if I'm missing something obvious, let me know.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@noelherrick Let me know if this needs another review. It's the same principle as the main Kit Plugin: Kit/convertkit-wordpress#840

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the reminder!

@n7studios n7studios merged commit 12147e4 into main Jul 9, 2025
162 of 200 checks passed
@n7studios n7studios deleted the automatically-refresh-token branch July 12, 2025 03:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants