# `WardrikOAuth.Renewal`

Keeps a principal's grant usable by refreshing it when it expires.

Refreshes take a cluster-wide lock, so two nodes never spend the same refresh token.

# `expire`

```elixir
@spec expire(map(), WardrikOAuth.Provider.t(), WardrikCore.Principal.t()) :: :ok
```

Marks the grant expired, so the next use refreshes it.

# `renew`

```elixir
@spec renew(map(), WardrikOAuth.Provider.t(), WardrikCore.Principal.t(), binary()) ::
  {:ok, String.t()} | :ask | {:error, term()}
```

Returns the grant's access token, refreshing it first if it has expired.

Returns `:ask` if the principal must sign in again.

---

*Consult [api-reference.md](api-reference.md) for complete listing*