social_auth | Social Auth service for TYPO3 with Hybrid Auth API | Authentication library

In your pipeline.py (create one, if you don't have it in your app directory), define a method:

It's most likely credentials = Credentials(get_access_token(request), scopes=SCOPES)

request.user_refresh_token is the value of the refresh token as well.

I also have a credentials.json file that contains a token_uri, client_id, and client_secret if that is correct which was used for login.

And, your question is to retrieve the access token using the refresh token. In this case, in order to retrieve the access token, how about the following sample script?

If client_id, client_secret, refresh_token and token_uri are put in a variable, you can use the following script.

So the adjustment would look like this:

The last step is change in settings.py to use this model as your user model. I

If we check the documentation for events.get we will find that this method operates on private user data which means that we need to be authorized to access it. On top of that we need to be authorized with one of the following scopes

I cant see from your code which scopes you are requesting. The first thing to do is to ensure that you are requesting one of the scopes above when authorizing your user. If you change the scopes remember you must request consent of the user again for it to take effect.

You must specify refresh_token, token_uri, client_id, and client_secret.

Sounds like you are not properly storing your refresh token. get_access_token wont work if it doesn't have a refresh token stored.

In the official sample notice how they store the user creds in token.json then the library will automatically request a new access token when it needs.

designates whether this user account should be considered active. We recommend that you set this flag to False instead of deleting accounts; that way, if your applications have any foreign keys to users, the foreign keys won’t break.

In your case, I would put is_active as True by default (if you want to delete an account, you just put it False).

Following your remark

(for other users who sign up using email-password I activate them by sending an account activation email)

you can add a boolean is_email_verified : if the user is created by social auth, it means the is_email_verified is True; if the user is created following email-password, is_email_verified is False and must be set to True by sending an account activation email.

Thanks to that you can have 4 states with the 2 booleans is_active and is_email_verified : a user who wants to connect must have both of them as True. It seems secure to me.

SOCIAL_AUTH_REDIRECT_IS_HTTPS = True