Skip to main content

Documentation Index

Fetch the complete documentation index at: https://auth0.com/llms.txt

Use this file to discover all available pages before exploring further.

​
Endpoint

POST /oauth/token Use this endpoint to refresh an Access Token using the Refresh Token you got during authorization.

​
Learn More

​
Headers

​
DPoP
string
A DPoP proof for the request. This is optional and only required if your application uses Demonstrating Proof-of-Possession.

​
Body Parameters

​
grant_type
string
required
Specifies the flow being used. For refreshing an access token, this must be set to refresh_token.Allowed values: refresh_token
​
client_id
string
required
The Client ID of your application, which identifies the application making the request.
​
client_secret
string
The Client Secret of your application. Required when the Token Endpoint Authentication Method is set to Post or Basic.
​
refresh_token
string
required
The refresh token that was previously issued to the client. This token is used to obtain a new access token.
​
scope
string
A space-delimited list of requested scope permissions. If omitted, the original scopes will be used; otherwise, you can request a reduced set of scopes. Note that this must be URL encoded.

​
Response Schema

​
Response Messages

StatusDescription
200Access token successfully refreshed.
400Bad Request. The request is missing required parameters or is malformed.
401Unauthorized. The client credentials are invalid or the refresh token is invalid.
403Forbidden. The refresh token is invalid or has expired.