Refresh Token
| Property | Value |
|---|---|
| Method | POST |
| Path | /api/refreshToken.do |
Authentication Header
Use Authorization: Basic <BASE64_CLIENT_CREDENTIALS>, where the credentials are Base64Encode(client_id + ":" + client_secret). This endpoint does not use Bearer authentication. Base64 is not encryption: use HTTPS and keep secrets on a trusted server.
URL Parameters
The source API document specifies these as URL parameters.
| Parameter | Type | Description |
|---|---|---|
grant_type |
string | Required; refresh_token |
refresh_token |
string | Required; previously issued refresh token |
Response Fields
| Field | Description |
|---|---|
access_token |
Credential for business API calls |
refresh_token |
Refresh credential; the source document specifies a 30-day lifetime |
expires_in |
Access-token lifetime in seconds; use the actual response when scheduling refreshes |
Store the latest returned credentials securely. Avoid concurrent refreshes overwriting each other; reauthorize when authentication is no longer valid. Do not expose codes or tokens in logs, monitored URLs, or screenshots. See the API overview for business-request headers; Basic authentication here does not apply to every business endpoint.