What scope to supply to get a refresh token from Stack Exchange?

Question

In the process of implementing a OAuth app for Stack Exchange, I noticed that none of the approaches that conventionally work - supplying a offline_access scope, for example - result in the OAuth exchange exchanging a code for both an access_token and a refresh_token.

Additionally, the documentation makes no mention of a refresh_token (in fact, /docs/authentication doesn't even contain the word 'refresh').

Is the expectation that the developer would always use no_expiry if they don't want to prompt the user to re-authenticate every day? Or is there a different request that I should be making?

URLs tried:

1. Valid request

/oauth?response_type=code
  &scope=read_inbox+private_info
  &state=ey...AA
  &client_id=1111
  &redirect_uri=https://valid_redirect_url

• Works fine, but gives me a token that's only valid for a day.

2. Add a refresh_token to the scope.

/oauth?response_type=code
  &scope=read_inbox+private_info+refresh_token
  &state=ey...AA
  &client_id=1111
  &redirect_uri=https://valid_redirect_url

• Scope error.

3. Add a offline_access to the scope.

/oauth?response_type=code
  &scope=read_inbox+private_info+offline_access
  &state=ey...AA
  &client_id=1111
  &redirect_uri=https://valid_redirect_url

• Scope error.

4. Add a grant_type=refresh_token to the scope.

/oauth?response_type=code
  &scope=read_inbox+private_info
  &state=ey...AA
  &client_id=1111
  &redirect_uri=https://valid_redirect_url
  &grant_type=refresh_token

• No change in response.

What is the correct process to acquire a refresh token, or should I always specify the no_expiry scope?

Answer 1

Disclaimer: I'm not a Stack Exchange employee, but I'm a frequent user of the API and moderator on Stack Apps.

You've read the documentation, kudos for that, and as you saw, it does not have the ability to produce a refresh token. The official Stack Exchange mobile apps (now discontinued) didn't use it either; they all use the no_expiry scope.