Refresh access token

POST/oauth2/token

Rotate an expiring access token for a new token pair.

The token endpoint, called with grant_type=refresh_token. Send the refresh token from your last token response and Qashio returns a new access token and a new refresh token. Refresh before the access token expires, or on the first 401 from an API call.

Your client_id and client_secret are required. These are confidential client credentials and must never be used from a browser or mobile app.

Refresh tokens are single use. Each refresh returns a new refresh token and invalidates the one you sent. If a refresh token is presented twice, Qashio treats it as a possible theft and revokes the whole token family, which signs the integration out: store the newest refresh token after every call.

This endpoint does not use the standard response envelope.

Request body

application/jsonrequired

Field	Type	Description
`grant_type`	string	Always `refresh_token`. Required
`client_id`	string	Your client identifier. Required
`client_secret`	string	Your client secret. Required
`refresh_token`	string	The refresh token to rotate. Required

JSON

{
  "grant_type": "refresh_token",
  "refresh_token": "rt_8f3a1c9e2b7d4a6c...",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET"
}

Response

200 with the new token set.

Field	Type	Description
`access_token`	string	Bearer token to send on API requests
`token_type`	string	Always `Bearer`
`refresh_token`	string	Use this on the next refresh; the one you sent no longer works
`scope`	string	Space-separated scopes granted, e.g. `cards:read cards:write transactions:read`

Response schema from the OpenAPI document

Field	Type	Description
`access_token`	string
`token_type`	string
`refresh_token`	string
`scope`	string

Errors

Status	Cause
`400`	Missing or unsupported parameters
`401`	Invalid client credentials; refresh token invalid, expired, revoked or reused

400Invalid grant / missing client credentials
401Invalid client, or refresh token invalid, expired, revoked or reused

Every error carries an errors[] array and a meta.request_id. See Errors for the full envelope.

POST/oauth2/token

curl -X POST 'https://api.qashio.com/oauth2/token' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "grant_type": "refresh_token",
    "refresh_token": "rt_8f3a1c9e2b7d4a6c...",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'

const accessToken = process.env.QASHIO_ACCESS_TOKEN;

const response = await fetch('https://api.qashio.com/oauth2/token', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "grant_type": "refresh_token",
    "refresh_token": "rt_8f3a1c9e2b7d4a6c...",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }),
});

if (!response.ok) {
  throw new Error(`Qashio API ${response.status}: ${await response.text()}`);
}

const { data, meta } = await response.json();
console.log(meta.request_id, data);

import https from 'node:https';

const url = new URL('https://api.qashio.com/oauth2/token');

const payload = await new Promise((resolve, reject) => {
  const req = https.request(
    url,
    {
      method: 'POST',
      headers: {
      Accept: 'application/json',
        'Content-Type': 'application/json',
      },
    },
    (res) => {
      let raw = '';
      res.on('data', (chunk) => (raw += chunk));
      res.on('end', () => resolve(JSON.parse(raw)));
    },
  );
  req.on('error', reject);
  req.write(JSON.stringify({
    "grant_type": "refresh_token",
    "refresh_token": "rt_8f3a1c9e2b7d4a6c...",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }));
  req.end();
});

console.log(payload.data);

import os
import requests

url = "https://api.qashio.com/oauth2/token"
headers = {
    "Accept": "application/json",
}

payload = {
  "grant_type": "refresh_token",
  "refresh_token": "rt_8f3a1c9e2b7d4a6c...",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET"
}

response = requests.post(url, headers=headers, json=payload, timeout=30)
response.raise_for_status()

body = response.json()
print(body["meta"]["request_id"], body["data"])

<?php

$ch = curl_init('https://api.qashio.com/oauth2/token');

curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST  => 'POST',
  CURLOPT_HTTPHEADER     => [
      'Accept: application/json',
      'Content-Type: application/json',
  ],
  CURLOPT_POSTFIELDS     => json_encode([
  'grant_type' => 'refresh_token',
  'refresh_token' => 'rt_8f3a1c9e2b7d4a6c...',
  'client_id' => 'YOUR_CLIENT_ID',
  'client_secret' => 'YOUR_CLIENT_SECRET'
]),
]);

$response = curl_exec($ch);
curl_close($ch);

$body = json_decode($response, true);
print_r($body['data']);

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

func main() {
	payload := []byte(`{
  "grant_type": "refresh_token",
  "refresh_token": "rt_8f3a1c9e2b7d4a6c...",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET"
}`)

	req, _ := http.NewRequest("POST", "https://api.qashio.com/oauth2/token", bytes.NewBuffer(payload))
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	var out map[string]any
	json.NewDecoder(res.Body).Decode(&out)
	fmt.Println(out["data"])
}

require 'net/http'
require 'json'
require 'uri'

uri = URI('https://api.qashio.com/oauth2/token')
request = Net::HTTP::Post.new(uri)
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = "{\n  \"grant_type\": \"refresh_token\",\n  \"refresh_token\": \"rt_8f3a1c9e2b7d4a6c...\",\n  \"client_id\": \"YOUR_CLIENT_ID\",\n  \"client_secret\": \"YOUR_CLIENT_SECRET\"\n}"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

body = JSON.parse(response.body)
puts body['data']

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class QashioExample {
  public static void main(String[] args) throws Exception {
    String payload = """
      {
        "grant_type": "refresh_token",
        "refresh_token": "rt_8f3a1c9e2b7d4a6c...",
        "client_id": "YOUR_CLIENT_ID",
        "client_secret": "YOUR_CLIENT_SECRET"
      }
      """;

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://api.qashio.com/oauth2/token"))
        .header("Accept", "application/json")
        .header("Content-Type", "application/json")
        .method("POST", HttpRequest.BodyPublishers.ofString(payload))
        .build();

    HttpResponse<String> response = HttpClient.newHttpClient()
        .send(request, HttpResponse.BodyHandlers.ofString());

    System.out.println(response.body());
  }
}

using System;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;

var client = new HttpClient();

var request = new HttpRequestMessage(new HttpMethod("POST"), "https://api.qashio.com/oauth2/token");
request.Headers.Add("Accept", "application/json");

var payload = @"{
  ""grant_type"": ""refresh_token"",
  ""refresh_token"": ""rt_8f3a1c9e2b7d4a6c..."",
  ""client_id"": ""YOUR_CLIENT_ID"",
  ""client_secret"": ""YOUR_CLIENT_SECRET""
}";
request.Content = new StringContent(payload, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();

Console.WriteLine(await response.Content.ReadAsStringAsync());

import Foundation

var request = URLRequest(url: URL(string: "https://api.qashio.com/oauth2/token")!)
request.httpMethod = "POST"
request.setValue("application/json", forHTTPHeaderField: "Accept")
request.setValue("application/json", forHTTPHeaderField: "Content-Type")
request.httpBody = """
{
  "grant_type": "refresh_token",
  "refresh_token": "rt_8f3a1c9e2b7d4a6c...",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET"
}
""".data(using: .utf8)

let (data, _) = try await URLSession.shared.data(for: request)
print(String(data: data, encoding: .utf8)!)

Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJDTzl5eTBtZnpxaHh0eGtrayIsImNvbXBhbnlfaWQiOiJDTzl5eTBtZnpxaHh0eGtrayIsInNjb3BlIjoiZXJwIiwiaWF0IjoxNzU3NDk3OTgwLCJleHAiOjE3NTc0OTg4ODB9...",
  "token_type": "Bearer",
  "refresh_token": "rt_8f3a1c9e2b7d4a6c0e5f9b1d3a7c2e4f8a0b1c2d...",
  "scope": "wallet:read cards:read cards:write transactions:read transactions:write users:read..."
}

{
  "status_code": 401,
  "success": false,
  "message": "Missing Bearer token",
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing Bearer token"
  },
  "errors": [
    {
      "code": "UNAUTHORIZED",
      "message": "Missing Bearer token",
      "field": "authorization"
    }
  ],
  "meta": {
    "request_id": "3adb2d16090c7b3bdbde3b326a814b30",
    "timestamp": "2026-09-09T10:07:52.143Z"
  }
}

{
  "status_code": 401,
  "success": false,
  "message": "Missing Bearer token",
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing Bearer token"
  },
  "errors": [
    {
      "code": "UNAUTHORIZED",
      "message": "Missing Bearer token",
      "field": "authorization"
    }
  ],
  "meta": {
    "request_id": "3adb2d16090c7b3bdbde3b326a814b30",
    "timestamp": "2026-09-09T10:07:52.143Z"
  }
}