{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-guides/product/account-setup/sidebars.yaml","api-docs-api-reference/@latest/index.yaml":"api-docs-api-reference/@latest/index.yaml"},"props":{"metadata":{"markdoc":{"tagList":["openapi-code-sample"]},"type":"markdown"},"seo":{"title":"Refreshing user access tokens","siteUrl":"https://docs.wise.com","projectTitle":"Wise Platform","description":"Wise Platform offer domestic and cross-border payments tools for technology platforms, banks and financial institutions."},"dynamicMarkdocComponents":["openapi"],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"refreshing-user-access-tokens","__idx":0},"children":["Refreshing user access tokens"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Whether you create an account using the registration code grant or the authorisation code grant, you must refresh your user access tokens before they expire."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["User access tokens are valid for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["12 hours"]},". Wise recommends refreshing user access tokens ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["6 hours"]}," before they expire."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"retrieve-user-tokens-with-refresh-token","__idx":1},"children":["Retrieve user tokens with refresh token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To refresh a user access token, send a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/api-reference/oauth-token/oauthtokencreate"},"children":["create OAuth token request"]}," with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["grant_type"]}," set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["refresh_token"]},"."]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"api-docs-api-reference/@latest/index.yaml","operationId":"oauthTokenCreate","parameters":{},"requestBody":{"grant_type":"refresh_token","refresh_token":"<REFRESH_TOKEN_HERE>"},"environments":{},"codeSamplesResolved":[{"lang":"shell","title":"curl","source":"curl -i -X POST \\\n  -u '<client_id>:<client_secret>' \\\n  https://api.wise.com/2026Q3/oauth/token \\\n  -H 'Content-Type: application/x-www-form-urlencoded' \\\n  -H 'X-External-Correlation-Id: f47ac10b-58cc-4372-a567-0e02b2c3d479' \\\n  -d grant_type=refresh_token \\\n  -d 'refresh_token=<REFRESH_TOKEN_HERE>'"},{"lang":"javascript","title":"JavaScript","source":"const formData = {\n  grant_type: 'refresh_token',\n  refresh_token: '<REFRESH_TOKEN_HERE>'\n};\n\nconst resp = await fetch(\n  `https://api.wise.com/2026Q3/oauth/token`,\n  {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n      'X-External-Correlation-Id': 'f47ac10b-58cc-4372-a567-0e02b2c3d479',\n      Authorization: 'Basic ' + btoa('<client_id>:<client_secret>')\n    },\n    body: new URLSearchParams(formData).toString()\n  }\n);\n\nconst data = await resp.text();\nconsole.log(data);"},{"lang":"javascript","title":"Node.js","source":"import fetch from 'node-fetch';\n\nasync function run() {\n  const formData = {\n    grant_type: 'refresh_token',\n    refresh_token: '<REFRESH_TOKEN_HERE>'\n  };\n\n  const resp = await fetch(\n    `https://api.wise.com/2026Q3/oauth/token`,\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        'X-External-Correlation-Id': 'f47ac10b-58cc-4372-a567-0e02b2c3d479',\n        Authorization: 'Basic ' + Buffer.from('<client_id>:<client_secret>').toString('base64')\n      },\n      body: new URLSearchParams(formData).toString()\n    }\n  );\n\n  const data = await resp.text();\n  console.log(data);\n}\n\nrun();"},{"lang":"python","title":"Python","source":"import requests\n\nurl = \"https://api.wise.com/2026Q3/oauth/token\"\n\npayload = {\n  \"grant_type\": \"refresh_token\",\n  \"refresh_token\": \"<REFRESH_TOKEN_HERE>\"\n}\n\nheaders = {\n  \"Content-Type\": \"application/x-www-form-urlencoded\",\n  \"X-External-Correlation-Id\": \"f47ac10b-58cc-4372-a567-0e02b2c3d479\"\n}\n\nresponse = requests.post(url, data=payload, headers=headers, auth=('<client_id>','<client_secret>'))\n\ndata = response.json()\nprint(data)"},{"lang":"java","title":"Java","source":"import java.net.*;\nimport java.net.http.*;\nimport java.util.*;\nimport java.nio.charset.StandardCharsets;\nimport java.util.stream.Collectors;\n\npublic class App {\n  public static void main(String[] args) throws Exception {\n    var httpClient = HttpClient.newBuilder().build();\n\n    HashMap<String, String> params = new HashMap<>();\n    params.put(\"grant_type\", \"refresh_token\");\n    params.put(\"refresh_token\", \"<REFRESH_TOKEN_HERE>\");\n\n    var form = params.keySet().stream()\n      .map(key -> key + \"=\" + URLEncoder.encode(params.get(key), StandardCharsets.UTF_8))\n      .collect(Collectors.joining(\"&\"));\n\n    var host = \"https://api.wise.com\";\n    var pathname = \"/2026Q3/oauth/token\";\n    var request = HttpRequest.newBuilder()\n      .POST(HttpRequest.BodyPublishers.ofString(form))\n      .uri(URI.create(host + pathname ))\n      .header(\"Content-Type\", \"application/x-www-form-urlencoded\")\n      .header(\"X-External-Correlation-Id\", \"f47ac10b-58cc-4372-a567-0e02b2c3d479\")\n      .header(\"Authorization\", \"Basic \" + Base64.getEncoder().encodeToString((\"<client_id>:<client_secret>\").getBytes()))\n      .build();\n\n    var response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());\n\n    System.out.println(response.body());\n  }\n}"},{"lang":"csharp","title":"C#","source":"using System;\nusing System.Net.Http;\nusing System.Threading.Tasks;\nusing System.Text;\nusing System.Collections.Generic;\nusing System.Net.Http.Headers;\n\npublic class Program\n{\n  public static async Task Main()\n  {\n    System.Net.Http.HttpClient client = new()\n    {\n      DefaultRequestHeaders =\n      {\n        {\"X-External-Correlation-Id\", \"f47ac10b-58cc-4372-a567-0e02b2c3d479\"},\n      }\n    };\n\n    string base64String = Convert.ToBase64String(Encoding.ASCII.GetBytes(\"<client_id>:<client_secret>\"));\n    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(@\"Basic\", base64String);\n\n\n    List<KeyValuePair<string, string>> postData = new List<KeyValuePair<string, string>>();\n    postData.Add(new KeyValuePair<string, string>(\"grant_type\", \"refresh_token\"));\n    postData.Add(new KeyValuePair<string, string>(\"refresh_token\", \"<REFRESH_TOKEN_HERE>\"));\n\n    using HttpResponseMessage request = await client.PostAsync(\"https://api.wise.com/2026Q3/oauth/token\", new FormUrlEncodedContent(postData));\n    string response = await request.Content.ReadAsStringAsync();\n\n    Console.WriteLine(response);\n  }\n}"},{"lang":"php","title":"PHP","source":"/**\n * Requires libcurl\n */\n\n$curl = curl_init();\n\n$payload = \"grant_type=refresh_token&refresh_token=<REFRESH_TOKEN_HERE>\";\n\ncurl_setopt_array($curl, [\n  CURLOPT_HTTPHEADER => [\n    \"Content-Type: application/x-www-form-urlencoded\",\n    \"X-External-Correlation-Id: f47ac10b-58cc-4372-a567-0e02b2c3d479\",\n    \"Authorization: Basic \" . base64_encode(\"<client_id>:<client_secret>\")\n  ],\n  CURLOPT_POSTFIELDS => $payload,\n  CURLOPT_URL => \"https://api.wise.com/2026Q3/oauth/token\",\n  CURLOPT_RETURNTRANSFER => true,\n  CURLOPT_CUSTOMREQUEST => \"POST\",\n]);\n\n$response = curl_exec($curl);\n$error = curl_error($curl);\n\ncurl_close($curl);\n\nif ($error) {\n  echo \"cURL Error #:\" . $error;\n} else {\n  echo $response;\n}"},{"lang":"go","title":"Go","source":"package main\n\nimport (\n  \"fmt\"\n  \"net/url\"\n  \"strconv\"\n  \"strings\"\n  \"net/http\"\n  \"io/ioutil\"\n)\n\nfunc main() {\n  reqUrl := \"https://api.wise.com/2026Q3/oauth/token\"\n  data := url.Values{}\n  data.Set(\"grant_type\", \"refresh_token\")\n  data.Set(\"refresh_token\", \"<REFRESH_TOKEN_HERE>\")\n  req, err := http.NewRequest(\"POST\", reqUrl, strings.NewReader(data.Encode()))\n  if err != nil {\n    panic(err)\n  }\n  req.SetBasicAuth(\"<client_id>\", \"<client_secret>\")\n  req.Header.Add(\"Content-Type\", \"application/x-www-form-urlencoded\")\n  req.Header.Add(\"X-External-Correlation-Id\", \"f47ac10b-58cc-4372-a567-0e02b2c3d479\")\n  req.Header.Add(\"Content-Length\", strconv.Itoa(len(data.Encode())))\n  res, err := http.DefaultClient.Do(req)\n  if err != nil {\n    panic(err)\n  }\n  defer res.Body.Close()\n  body, err := ioutil.ReadAll(res.Body)\n  if err != nil {\n    panic(err)\n  }\n\n  fmt.Println(res)\n  fmt.Println(string(body))\n}"},{"lang":"ruby","title":"Ruby","source":"require 'uri'\nrequire 'net/http'\nrequire 'openssl'\n\nurl = URI('https://api.wise.com/2026Q3/oauth/token')\n\nhttp = Net::HTTP.new(url.host, url.port)\nhttp.use_ssl = true\n\nrequest = Net::HTTP::Post.new(url)\nrequest['Content-Type'] = 'application/x-www-form-urlencoded'\nrequest['X-External-Correlation-Id'] = 'f47ac10b-58cc-4372-a567-0e02b2c3d479'\nrequest.body = URI.encode_www_form({\n  grant_type: 'refresh_token',\n  refresh_token: '<REFRESH_TOKEN_HERE>'\n})\nrequest.basic_auth('<client_id>', '<client_secret>')\n\nresponse = http.request(request)\nputs response.read_body\n"},{"lang":"r","title":"R","source":"library(httr)\n\nbody <- list(\n  grant_type = \"refresh_token\",\n  refresh_token = \"<REFRESH_TOKEN_HERE>\"\n)\n\nurl = \"https://api.wise.com/2026Q3/oauth/token\"\n\ndata_req <- POST(\n  url,\n  authenticate(\"<client_id>\", \"<client_secret>\")\n  add_headers(\"Content-Type\" = \"application/x-www-form-urlencoded\", \"X-External-Correlation-Id\" = \"f47ac10b-58cc-4372-a567-0e02b2c3d479\"),\n  body = body,\n  encode = \"form\",\n  verbose()\n)\n\ncontent(data_req)"},{"lang":"clike","title":"Payload application/x-www-form-urlencoded","source":"grant_type=client_credentials"}]},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The response returns a new ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["access_token"]}," value and the prior user access token is immediately invalidated."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"expired-revoked-or-lost-refresh-tokens","__idx":2},"children":["Expired, revoked, or lost refresh tokens"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you receive an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["invalid_grant"]}," error when attempting to refresh a user access token, you may have an expired or revoked refresh token."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Should your refresh token expire, get revoked, or you otherwise lose access to it, you must send a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/api-reference/oauth-token/oauthtokencreate"},"children":["create OAuth token request"]}," using your corresponding grant type (registration code or authorization code) to generate new user access and refresh tokens."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you do this, the old refresh token is immediately invalidated. If the last user access token generated by that refresh token is not expired, it will remain active until it expires or is replaced."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/developer/auth-and-security/refresh-tokens"},"children":["Refresh tokens guide"]}," for further detail on creating and managing refresh tokens as well as available recovery scenarios."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Review the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/developer/auth-and-security/oauth-2-setup"},"children":["OAuth 2.0 setup guide"]}," for more details about token management and lifecycles."]}]},"headings":[{"value":"Refreshing user access tokens","id":"refreshing-user-access-tokens","depth":1},{"value":"Retrieve user tokens with refresh token","id":"retrieve-user-tokens-with-refresh-token","depth":2},{"value":"Expired, revoked, or lost refresh tokens","id":"expired-revoked-or-lost-refresh-tokens","depth":2}],"frontmatter":{"seo":{"title":"Refreshing user access tokens"}},"lastModified":"2026-09-23T14:49:17.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/product/account-setup/refreshing-access","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}