# Refresh access token

Use the refresh token to generate another access token for the same set of scopes.

Using a refresh token, your app can create up to ten access tokens in a span of ten minutes. If the limit is reached, the access token creation will be blocked for the rest of the ten minutes. For more information, refer to [Token limits](https://www.zoho.com/accounts/protocol/oauth/token-limits.html).

## Query parameters

| Parameter | Description |
|---|---|
| `client_id` | required<br><br>The unique ID of your application. You can find this in the [API console](https://api-console.zoho.com/). |
| `client_secret` | required<br><br>The unique secret for your app which is known only to your app and Zoho. You can find this in the [API console](https://api-console.zoho.com/). |
| `grant_type` | required<br><br>Should be sent with the value `refresh_token`. |
| `refresh_token` | required<br><br>The refresh token you received after you made the [polling request](https://www.zoho.com/accounts/protocol/oauth/devices/polling-request.html). |

## Response parameters

| Parameter | Description |
|---|---|
| `access_token` | A token that your app needs to access the resources (as defined by the requested scopes). This token is valid for 1 hour. |
| `api_domain` | The domain to which your app needs to make API requests, for accessing the protected resources. |
| `token_type` | Indicates the type of access token that is generated. The access tokens issued by Zoho are [Bearer](https://datatracker.ietf.org/doc/html/rfc6750) tokens. When your app makes API requests to access the protected resources, access tokens need to be sent using the "Authorization" header.<br><br>Syntax:<br>`Authorization: Zoho-oauthtoken {access token}` |
| `expires_in` | Indicates the time (in seconds) in which the access token expires. The lifetime of an access token is **1 hour** (3600 seconds). |

## Error codes

| Error | Reasons |
|---|---|
| `invalid_client` | - The accounts-server URL is invalid. Check if the URL is corresponding to the user's datacenter location. [See all URLs](https://accounts.zoho.com/oauth/serverinfo)<br>- The parameter `client_id` is missing or its value is invalid.<br>- The value of the parameter `grant_type` is invalid. It must be `refresh_token`. |
| `invalid_client_secret` | - The parameter `client_secret` is missing or its value is invalid. |
| `invalid_code` | - The parameter `refresh_token` is missing or its value is invalid.<br>- The value of the parameter `grant_type` is incorrect. It must be `refresh_token`.<br>- The refresh token used is already revoked. Learn more |
| `400 Bad Request` | - The HTTP method used is incorrect. It must be POST.<br>- The parameter `grant_type` is missing. |

## Endpoint

```
POST   {accounts-server-url}/oauth/v2/token
```

**Note**: The [accounts-server-url](https://accounts.zoho.com/oauth/serverinfo) is specific to the location (i.e., datacenter) where the user is present.

## Request example

```curl
https://accounts.zoho.com/oauth/v2/token
?grant_type=refresh_token
&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0
&client_secret=122c324d3496d5d7eeebc129470715fbb856b7
&refresh_token=1000.86a03ca5dbfccb7445889b8215efb0.cad1ae4989a1196fe05aa729fcb4e1
```

## Response example

```json
{
  "access_token": "1004.ce70fccd3edf901d37859fe5124ae975.f61ca1a9d7979387cc02fb3f279",
  "api_domain": "https://www.zohoapis.com",
  "token_type": "Bearer",
  "expires_in": 3600
}
```