Whether you create an account using the registration code grant or the authorisation code grant, you must refresh your user access tokens before they expire.
User access tokens are valid for 12 hours. Wise recommends refreshing user access tokens 6 hours before they expire.
To refresh a user access token, send a create OAuth token request with grant_type set to refresh_token.
- Production Environmenthttps://api.wise.com/2026Q3/oauth/token
- Sandbox Environmenthttps://api.wise-sandbox.com/2026Q3/oauth/token
curl -i -X POST \
-u '<client_id>:<client_secret>' \
https://api.wise.com/2026Q3/oauth/token \
-H 'Content-Type: application/x-www-form-urlencoded' \
-H 'X-External-Correlation-Id: f47ac10b-58cc-4372-a567-0e02b2c3d479' \
-d grant_type=client_credentialsThe response returns a new access_token value and the prior user access token is immediately invalidated.
If you receive an invalid_grant error when attempting to refresh a user access token, you may have an expired or revoked refresh token.
Should your refresh token expire, get revoked, or you otherwise lose access to it, you must send a create OAuth token request using your corresponding grant type (registration code or authorization code) to generate new user access and refresh tokens.
When you do this, the old refresh token is immediately invalidated. If the last user access token generated by that refresh token is not expired, it will remain active until it expires or is replaced.
See the Refresh tokens guide for further detail on creating and managing refresh tokens as well as available recovery scenarios.
Review the OAuth 2.0 setup guide for more details about token management and lifecycles.