Add latest changes from gitlab-org/gitlab@14-2-stable-eev14.2.0-rc42

1 files changed, 45 insertions, 1 deletions

diff --git a/doc/api/oauth2.md b/doc/api/oauth2.md
index 1b06e554e5e..ce455c89d1a 100644
--- a/doc/api/oauth2.md
+++ b/doc/api/oauth2.md
@@ -83,7 +83,7 @@ Before starting the flow, generate the `STATE`, the `CODE_VERIFIER` and the `COD
   which use the characters `A-Z`, `a-z`, `0-9`, `-`, `.`, `_`, and `~`.
 - The `CODE_CHALLENGE` is an URL-safe base64-encoded string of the SHA256 hash of the
   `CODE_VERIFIER`
-  - In Ruby, you can set that up with `Base64.urlsafe_encode64(Digest::SHA256.digest(CODE_VERIFIER))`.
+  - In Ruby, you can set that up with `Base64.urlsafe_encode64(Digest::SHA256.digest(CODE_VERIFIER), padding: false)`.
 
 1. Request authorization code. To do that, you should redirect the user to the
    `/oauth/authorize` page with the following query parameters:
@@ -123,6 +123,28 @@ Before starting the flow, generate the `STATE`, the `CODE_VERIFIER` and the `COD
     "created_at": 1607635748
    }
    ```
+   
+1. To retrieve a new `access_token`, use the `refresh_token` parameter. Refresh tokens may
+   be used even after the `access_token` itself expires. This request:
+   - Invalidates the existing `access_token` and `refresh_token`.
+   - Sends new tokens in the response.
+
+   ```ruby
+     parameters = 'client_id=APP_ID&client_secret=APP_SECRET&refresh_token=REFRESH_TOKEN&grant_type=refresh_token&redirect_uri=REDIRECT_URI&code_verifier=CODE_VERIFIER'
+     RestClient.post 'https://gitlab.example.com/oauth/token', parameters
+   ```
+
+   Example response:
+    
+   ```json
+   {
+     "access_token": "c97d1fe52119f38c7f67f0a14db68d60caa35ddc86fd12401718b649dcfa9c68",
+     "token_type": "bearer",
+     "expires_in": 7200,
+     "refresh_token": "803c1fd487fec35562c205dac93e9d8e08f9d3652a24079d704df3039df1158f",
+     "created_at": 1628711391
+   }
+   ```
 
 NOTE:
 The `redirect_uri` must match the `redirect_uri` used in the original
@@ -181,6 +203,28 @@ be used as a CSRF token.
     "created_at": 1607635748
    }
    ```
+   
+1. To retrieve a new `access_token`, use the `refresh_token` parameter. Refresh tokens may
+   be used even after the `access_token` itself expires. This request:
+   - Invalidates the existing `access_token` and `refresh_token`.
+   - Sends new tokens in the response.
+
+   ```ruby
+     parameters = 'client_id=APP_ID&client_secret=APP_SECRET&refresh_token=REFRESH_TOKEN&grant_type=refresh_token&redirect_uri=REDIRECT_URI'
+     RestClient.post 'https://gitlab.example.com/oauth/token', parameters
+   ```
+
+   Example response:
+
+   ```json
+   {
+     "access_token": "c97d1fe52119f38c7f67f0a14db68d60caa35ddc86fd12401718b649dcfa9c68",
+     "token_type": "bearer",
+     "expires_in": 7200,
+     "refresh_token": "803c1fd487fec35562c205dac93e9d8e08f9d3652a24079d704df3039df1158f",
+     "created_at": 1628711391
+   }
+   ```
 
 NOTE:
 The `redirect_uri` must match the `redirect_uri` used in the original