### Code of Conduct - [x] I have read and agree to the GitHub Docs project's [Code of Conduct](https://github.com/github/docs/blob/main/.github/CODE_OF_CONDUCT.md) ### What article on docs.github.com is affected? [Authenticating to the REST API with an OAuth app](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authenticating-to-the-rest-api-with-an-oauth-app) ```ruby def authenticated? session[:access_token] end ``` ### What changes are you suggesting? Change that line to check for `refresh_token` instead. In production environments, likely in a language other than Ruby, these tokens would be expiring cookies, and the checks for them would be server-side to avoid exposing the cookies to JavaScript code; however, the logic could be easily adapted if not for one mistake in it: the access token would expire before the refresh token, and discarding the user's authentication due to the access token being missing would discard their authentication in less than a day. If that line of code is changed to `refresh_token`, the rest of the code will play out the same: if the user has a valid access token, it won't be refreshed; if it's missing or invalid, it will. ### Additional information _No response_