---
title: "Refresh access token"
description: "Rotate an expiring access token for a new token pair."
source: https://developers.qashio.com/v2/reference/post-oauth2-token-refresh-token/
---

# Refresh access token

`POST /oauth2/token`

Does not require a Bearer access token.

**Purpose.** Rotate an expiring access token for a new token pair.

**Description.** The token endpoint, called with `grant_type=refresh_token`. Send the refresh token
from your last token response and Qashio returns a new access token and a new refresh token. Refresh
before the access token expires, or on the first `401` from an API call.

Your `client_id` and `client_secret` are required. These are confidential client credentials and
must never be used from a browser or mobile app.

**Refresh tokens are single use.** Each refresh returns a new refresh token and invalidates the one
you sent. If a refresh token is presented twice, Qashio treats it as a possible theft and revokes the
whole token family, which signs the integration out — store the newest refresh token after every
call.

This endpoint does not use the standard response envelope.

**Input (body, `application/json`).**

| Field | Type | Description |
| --- | --- | --- |
| `grant_type` | string | Always `refresh_token`. Required |
| `client_id` | string | Your client identifier. Required |
| `client_secret` | string | Your client secret. Required |
| `refresh_token` | string | The refresh token to rotate. Required |

```json
{
  "grant_type": "refresh_token",
  "refresh_token": "rt_8f3a1c9e2b7d4a6c...",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET"
}
```

**Output.** `200` with the new token set.

| Field | Type | Description |
| --- | --- | --- |
| `access_token` | string | Bearer token to send on API requests |
| `token_type` | string | Always `Bearer` |
| `refresh_token` | string | Use this on the next refresh; the one you sent no longer works |
| `scope` | string | Space-separated scopes granted, e.g. `cards:read cards:write transactions:read` |

**Errors.**

| Status | Cause |
| --- | --- |
| `400` | Missing or unsupported parameters |
| `401` | Invalid client credentials; refresh token invalid, expired, revoked or reused |

### Request body

```json
{
  "grant_type": "refresh_token",
  "client_id": "qc_xxx",
  "client_secret": "••••",
  "refresh_token": "rt_8f3a1c9e2b7d4a6c0e5f9b1d3a7c2e4f8a0b1c2d..."
}
```

### Example request

```bash
curl -X POST 'https://api.qashio.com/oauth2/token' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "grant_type": "refresh_token",
    "refresh_token": "rt_8f3a1c9e2b7d4a6c...",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'
```

### Example response (200)

```json
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJDTzl5eTBtZnpxaHh0eGtrayIsImNvbXBhbnlfaWQiOiJDTzl5eTBtZnpxaHh0eGtrayIsInNjb3BlIjoiZXJwIiwiaWF0IjoxNzU3NDk3OTgwLCJleHAiOjE3NTc0OTg4ODB9...",
  "token_type": "Bearer",
  "refresh_token": "rt_8f3a1c9e2b7d4a6c0e5f9b1d3a7c2e4f8a0b1c2d...",
  "scope": "wallet:read cards:read cards:write transactions:read transactions:write users:read..."
}
```

### Errors

- `400` Invalid grant / missing client credentials
- `401` Invalid client, or refresh token invalid, expired, revoked or reused