The OAuth 2.0 access token refresh request is sent by the client to the RapidIdentity token endpoint to obtain a new access token using a refresh token. Refresh tokens are issued only when the client is configured to receive them.
Endpoint
Method:
POSTPath:
/idp/profile/oauth2/tokenContent-Type:
application/x-www-form-urlencoded
Request Parameters
| Parameter | Recommendation | Description |
|---|---|---|
grant_type | Required | Set to refresh_token. |
refresh_token | Required | The refresh token previously issued by RapidIdentity. |
scope | Optional | A space-separated list of scopes for the new access token. Cannot exceed the scope of the original grant. |
Example Request
POST /idp/profile/oauth2/token HTTP/1.1
Host: rapididentity.example.com
Authorization: Basic ZXhhbXBsZS1jbGllbnQ6c2VjcmV0
Content-Type: application/x-www-form-urlencoded
grant_type=refresh_token
&refresh_token=tGzv3JOkF0XG5Qx2TlKWIARefresh Token Rotation
Important:
For public clients, the OAuth 2.0 best current practice (RFC 9700) requires refresh token rotation. Each time a refresh token is used, RapidIdentity issues a new refresh token and invalidates the previous one. The client must update its stored refresh token after each refresh.