A common case is to use AzureAD via OpenIdConnect for login - and then wanting to consume GraphAPI services.

In order to consume GraphAPI you will need a shortlived Access_token.

To get the fresh Access_token you will need a Refresh_token.

To get the Refresh_token you must do a call to the token-endpoint with the short lived code you get when you login.

Turnkey will do all this for you and update the SysUserClaim object with a ClaimType access_token and refresh_token.

These will be fetched when you login.

The access_token is shortlived - and you should renew it prior to new operations.

Turnkey can renew if your you if you add and later call a Method on SysUser :

OpenIdConnectAccessTokenRefresh():String (TV: Eco.ExternalLateBound) - this will return an error or ok, if ok the SysUserClaim object with a ClaimType access_token and refresh_token has been updated.