Refresh Token Grant

When the authorization code grant succeeds, the token response includes a refresh_token. Exchange it for a new access token without requiring the user to authenticate again.

Token endpoint: POST /oauth2/token

Parameter	Required	Description
grant_type	Yes	Must be refresh_token
refresh_token	Yes	The refresh token from a previous token response
client_id	Yes	The application's client ID
client_secret	Confidential clients	The application's client secret

curl -s -X POST http://localhost:8080/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=refresh_token" \
  --data-urlencode "refresh_token=<refresh_token>" \
  --data-urlencode "client_id=<client_id>"

The response is a new token set identical in shape to the authorization code response — new access_token, new refresh_token, same scopes. Refresh tokens are single-use; a second request with the same token returns invalid_grant.

See Authorization Code Grant for how the original refresh_token is issued, and the API Reference for the full OpenAPI contract.