Prevent save_token() from being called twice within create_token_response(). We call save_token() after any token modifiers have run so we can tell the token_handler's create_token() method not to save the token and do that explicitly ourselves.

1 files changed, 1 insertions, 1 deletions

diff --git a/oauthlib/oauth2/rfc6749/grant_types/refresh_token.py b/oauthlib/oauth2/rfc6749/grant_types/refresh_token.py
index 209b8a2..cb26880 100644
--- a/oauthlib/oauth2/rfc6749/grant_types/refresh_token.py
+++ b/oauthlib/oauth2/rfc6749/grant_types/refresh_token.py
@@ -61,7 +61,7 @@ class RefreshTokenGrant(GrantTypeBase):
             return headers, e.json, e.status_code
 
         token = token_handler.create_token(request,
-                                           refresh_token=self.issue_new_refresh_tokens)
+                                           refresh_token=self.issue_new_refresh_tokens, save_token=False)
 
         for modifier in self._token_modifiers:
             token = modifier(token)