Refresh Token

POST/v1/token

Refresh an Access Token

Use this endpoint to exchange a refresh token for a new access token. You should do this when:

• The access token has expired (~30 days)
• The access token has been compromised and needs to be rotated

Avoid re-authenticating with your clientId and clientSecret on every request — refresh tokens exist to keep those credentials out of frequent network traffic.

A refresh token is returned alongside the access token when you first authenticate via Client Credentials or Authorization Code. Store both tokens securely.

---

Step 1: Get Your Client ID and Client Secret

Go to RM Merchant Portal > Developer > Application.

clientIdStringrequired

Your application's Client ID from the Merchant Portal.

Example: 3208919753194101125

clientSecretStringrequired

Your application's Client Secret from the Merchant Portal.

Example: mglve4W3UhPSGOV7gnwoYKyvbRCe83zZ

---

Step 2: Base64-encode Your Credentials

Concatenate your clientId and clientSecret with a colon, then Base64-encode the result.

Before encoding:

Plain Credentials

Text

3675930941412424316:wmn7FUauXHdkoYa9182kCMkjGnNJVgin

After Base64 encoding:

Base64 Encoded

Text

MzY3NTkzMDk0MTQxMjQyNDMxNjp3bW43RlVhdVhIZGtvWWE5MTgya0NNa2pHbk5KVmdpbg==

---

Step 3: Make the Request

Include the Base64-encoded credentials in the Authorization header, and pass the refresh token in the request body.

Headers:

Request Headers

Text

Content-Type: application/json
Authorization: Basic MzY3NTkzMDk0MTQxMjQyNDMxNjp3bW43RlVhdVhIZGtvWWE5MTgya0NNa2pHbk5KVmdpbg==

Body:

grantTypeStringrequired

Must be set to "refresh_token".

Example: "refresh_token"

refreshTokenStringrequired

The refresh token returned when you last authenticated.

Example: "OgoHjoZy..."

---

Response Parameters

accessTokenString

New Bearer token to use in subsequent API requests.

Example: eyJhbGci...

tokenTypeString

Token scheme. Always "Bearer".

Example: "Bearer"

expiresInNumber

New access token lifetime in seconds. 2,591,999 seconds ≈ 30 days.

Example: 2591999

refreshTokenString

A new refresh token. Replace your stored refresh token with this value.

Example: XtBwKrib...

refreshTokenExpiresInNumber

New refresh token lifetime in seconds. Store this value to know when you need to re-authenticate from scratch.

Example: 1576799999