There's more...

As presented by this recipe, the grant types allowed for using refresh tokens are the Authorization Code and Password grant types. Notice that both grant types are aimed at confidential clients. That is, applications capable of using both described grant types are client types which are able to store confidential data in a safe manner. When working with public clients, you are not supposed to use refresh tokens because public clients can't store the refresh token safely.

The request for an access token when using refresh tokens must also be encrypted by SSL/TLS, as mentioned before, initiating any interaction between the OAuth 2.0 Provider and the client.