jaredhanson/oauth2orize — pull request #42 by tellnes (2013-06-21 12:35:02+00:00)
Title: remove refresh token from client credentials grant

RFC6749, Section 4.4.3 states the following:

A refresh token SHOULD NOT be included.

I think since the spec states that this should not be included, the user should explicit include it in the params if he wants it. Now it is like you should implement it.