curl --request POST \
--url https://oauth2-{dc}.moengage.com/v1/oauth/refresh \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=refresh_token \
--data client_id=YOUR_WORKSPACE_ID \
--data refresh_token=550e8400-e29b-41d4-a716-446655440000{
"access_token": "eyJhbGciOiJSUzI1NiJ9.<new-payload>.<new-signature>",
"token_type": "Bearer",
"expires_in": 900,
"refresh_token_expires_in": 86400
}{
"status": "FAILURE",
"error_type": "ER021",
"reason": "refresh_token is required."
}{
"status": "FAILURE",
"error_type": "ER010",
"reason": "Refresh token is not valid."
}{
"status": "FAILURE",
"error_type": "<string>",
"reason": "<string>"
}{
"status": "FAILURE",
"error_type": "RATE_LIMIT_EXCEEDED",
"reason": "Too many requests."
}Refresh Access Token
Exchange a refresh token for a new access token. The refresh request does not use your API key.
A refresh returns a new access token and does not issue a new refresh token. Continue using the same refresh token. Each successful refresh keeps the refresh token alive for another 24 hours, up to 30 days from the moment MoEngage issued the token. When refresh_token_expires_in approaches 0, or when a refresh returns ER010, call Generate Access Token again with your client_id and client_secret.
For the end-to-end integration, refer to OAuth 2.0 Overview. For the recommended refresh timing, refer to Recommended Practices.
curl --request POST \
--url https://oauth2-{dc}.moengage.com/v1/oauth/refresh \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=refresh_token \
--data client_id=YOUR_WORKSPACE_ID \
--data refresh_token=550e8400-e29b-41d4-a716-446655440000{
"access_token": "eyJhbGciOiJSUzI1NiJ9.<new-payload>.<new-signature>",
"token_type": "Bearer",
"expires_in": 900,
"refresh_token_expires_in": 86400
}{
"status": "FAILURE",
"error_type": "ER021",
"reason": "refresh_token is required."
}{
"status": "FAILURE",
"error_type": "ER010",
"reason": "Refresh token is not valid."
}{
"status": "FAILURE",
"error_type": "<string>",
"reason": "<string>"
}{
"status": "FAILURE",
"error_type": "RATE_LIMIT_EXCEEDED",
"reason": "Too many requests."
}Rate Limit
This endpoint allows 30 requests per 10 minutes and 5 requests per minute. Both limits apply perclient_id and refresh_token pair. A 429 response includes a Retry-After header that gives the number of seconds to wait. The same value also appears in the deprecated X-RETRY-AFTER header. Read Retry-After.
Refresh proactively, a few minutes before the access token expires, instead of waiting for an ER008 on an API call. Use the expires_in value returned with the access token to schedule the refresh.
Refresh at least once every 24 hours. A refresh token that goes unused for 24 hours expires, and the access tokens issued from that refresh token stop working even when expires_in has not run out.Body
The form-encoded parameters for the refresh token grant.
The OAuth 2.0 grant type. The supported value is refresh_token.
refresh_token Your Workspace ID. The value must match the Workspace ID that the refresh token was issued to, or the request fails with ER010.
The refresh token returned by Generate Access Token. The refresh token expires after 24 hours without a refresh, and after 30 days at most.
Response
MoEngage issued a new access token. The response does not carry a new refresh token. The refresh token sent in the request stays valid for another 24 hours, up to 30 days from the moment MoEngage issued the token.
The new access token that you send as a Bearer token on your API requests.
The token type. The value is always Bearer.
"Bearer"
The lifetime of the new access token, in seconds. The value reflects the Expiry time (in minutes) set on the API key.
900
The number of seconds until the refresh token expires if you do not use the token. Each successful refresh resets the value to 24 hours, or less when the refresh token approaches its 30-day limit.
86400