Skip to content
Last updated

Refreshing user access tokens

Whether you create an account using the registration code grant or the authorisation code grant, you must refresh your user access tokens before they expire.

User access tokens are valid for 12 hours. Wise recommends refreshing user access tokens 6 hours before they expire.

Retrieve user tokens with refresh token

To refresh a user access token, send a create OAuth token request with grant_type set to refresh_token.

curl -i -X POST \
  -u '<client_id>:<client_secret>' \
  https://api.wise.com/2026Q3/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'X-External-Correlation-Id: f47ac10b-58cc-4372-a567-0e02b2c3d479' \
  -d grant_type=client_credentials

The response returns a new access_token value and the prior user access token is immediately invalidated.

Expired, revoked, or lost refresh tokens

If you receive an invalid_grant error when attempting to refresh a user access token, you may have an expired or revoked refresh token.

Should your refresh token expire, get revoked, or you otherwise lose access to it, you must send a create OAuth token request using your corresponding grant type (registration code or authorization code) to generate new user access and refresh tokens.

When you do this, the old refresh token is immediately invalidated. If the last user access token generated by that refresh token is not expired, it will remain active until it expires or is replaced.

See the Refresh tokens guide for further detail on creating and managing refresh tokens as well as available recovery scenarios.

Review the OAuth 2.0 setup guide for more details about token management and lifecycles.