---
title: "OAuth Token Refresh"
method: POST
path: "/oauth/token?refresh"
tags: ["OAuth"]
---

# OAuth Token Refresh

`POST /oauth/token?refresh`

Access tokens are only valid for a given period of time (typically one hour) for security reasons. Whenever acquiring an new access token its TTL is also given (see `expires_in`), along with a refresh token that can be used to acquire a new access token after the current one has expired.

## Request body

- OAuthTokenRefreshRequest
  - `grant_type` string, required — When refreshing an existing token use `refresh_token`.
  - `refresh_token` string, required — The token provided when you got the expired access token.
  - `client_id` string — The client ID for your API app. Required for new API apps. To enhance security, we recommend making it required for existing apps in your app settings.
  - `client_secret` string — The client secret for your API app. Required for new API apps. To enhance security, we recommend making it required for existing apps in your app settings.

## Response `200`

successful operation

- OAuthTokenResponse
  - `access_token` string
  - `token_type` string
  - `refresh_token` string
  - `expires_in` integer — Number of seconds until the `access_token` expires. Uses epoch time.
  - `state` string, nullable

## Other responses

- `4XX` — failed_operation

---

[API](https://skmtc.net/hellosign/apis/dropbox-sign-api.md) · [All operations](https://skmtc.net/hellosign/apis/dropbox-sign-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hellosign/dropbox-sign-api/versions/2ea3f04008af/schema)