OAuth APM as Authorisation server

Hi AlexS_yb 

You right, in Oauth AS use case, APM does not keep session up. As soon as the token is issued, the session is deleted.

If client presents a refresh token, the previous values from the first request should be used. 

I'm curious to know which kind of information you want to update during a "token refresh". As if something changed on Owner side, a new authentication is required, then new session var (claims) are issued.