Refresh Token

Refresh Token

The flow for using the refresh token obtained in the Authorization Code flow is a way to let the integrator reuse the permissions granted in a flow to generate new tokens.

Particularities

The refresh token has a 10-day duration and, every time it is used, its duration is reset to 10 days. This way, you can use the token indefinitely, as long as there is no desire to change the scopes present in the flow.

In addition, whenever an access token is generated through the refresh token, the old access token is invalidated if it is still within the duration period of an access token (24h).

The Client can send a request providing the refresh token corresponding to the expired access token:

POST /oauth2/token HTTP/1.1
Host: id.btgpactual.com
Content-type: application/x-www-form-urlencoded
Authorization: Basic <client_id:client_secret> // Base 64 encoded

grant_type=refresh_token&refresh_token={refresh_token}

And will then receive as a response a new Access Token, and the Refresh Token will have its duration renewed:

HTTP/1.1 200 OK
Content-Type: application/json

{
    "access_token":"eyJhbGciOiJSUzI1NiIsI",
    "refresh_token":"WV6G4HKBrvgiLoFdMBiVx",
    "scope":"apps email openid profile webhooks",
    "id_token":"eyJhbGciOiJIUzI1NiJ9.eyJz",
    "token_type":"Bearer",
    "expires_in":86400
}

HTTP/1.1 200 OK
Content-Type: application/json

{
    "access_token":"eyJhbGciOiJSUzI1NiIsI",
    "refresh_token":"WV6G4HKBrvgiLoFdMBiVx",
    "scope":"apps email openid profile webhooks",
    "id_token":"eyJhbGciOiJIUzI1NiJ9.eyJz",
    "token_type":"Bearer",
    "expires_in":86400
}