---
title: "Refresh access token"
method: POST
path: "/oauth2/token#refresh"
tags: ["Authorization"]
---

# Refresh access token

`POST /oauth2/token#refresh`

Refresh an Access Token using its client ID, secret, and refresh token.

## Response `200`

Returns a new Access Token that can be used to make authenticated
API calls by passing along the token in a authorization header as
follows `Authorization: Bearer <Token>`.

- AccessToken — A token that can be used to make authenticated API calls.
  - `access_token` string, token — The requested access token.
  - `expires_in` integer — The time in seconds by which this token will expire.
  - `token_type` 'bearer' — The type of access token returned.
  - `restricted_to` ResourceScope[] — The permissions that this access token permits, providing a list of resources (files, folders, etc) and the scopes permitted for each of those resources.
    - `scope` 'annotation_edit' | 'annotation_view_all' | 'annotation_view_self' | 'base_explorer' | 'base_picker' | 'base_preview' | 'base_upload' | 'item_delete' | 'item_download' | 'item_preview' | 'item_rename' | 'item_share' | 'item_upload' | 'item_read' — The scopes for the resource access.
    - `object` union — The file or folder resource.
      - object — The bare basic representation of a folder, the minimal amount of fields returned when using the `fields` query parameter.
        - `id` string, required — The unique identifier that represent a folder. The ID for any folder can be determined by visiting a folder in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/folders/123` the `folder_id` is `123`.
        - `etag` string, nullable — The HTTP `etag` of this folder. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the folder if (no) changes have happened.
        - `type` 'folder', required — The value will always be `folder`.
        - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
        - `name` string — The name of the folder.
      - object, nullable — The bare basic representation of a file, the minimal amount of fields returned when using the `fields` query parameter.
        - `id` string, required — The unique identifier that represent a file. The ID for any file can be determined by visiting a file in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/files/123` the `file_id` is `123`.
        - `etag` string, nullable — The HTTP `etag` of this file. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the file if (no) changes have happened.
        - `type` 'file', required — The value will always be `file`.
        - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
        - `name` string — The name of the file.
        - `sha1` string, digest — The SHA1 hash of the file. This can be used to compare the contents of a file on Box with a local file.
        - `file_version` object — The information about the current version of the file.
          - `id` string, required — The unique identifier that represent a file version.
          - `type` 'file_version', required — The value will always be `file_version`.
          - `sha1` string — The SHA1 hash of this version of the file.
  - `refresh_token` string, token — The refresh token for this access token, which can be used to request a new access token when the current one expires.
  - `issued_token_type` 'urn:ietf:params:oauth:token-type:access_token', urn — The type of downscoped access token returned. This is only returned if an access token has been downscoped.

## Other responses

- `400` — An authentication error.
- `default` — An authentication error.

---

[API](https://skmtc.net/box/apis/platform-api.md) · [All operations](https://skmtc.net/box/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/box/platform-api/revisions/ba8f087e1a4d/schema)