Refreshing Tokens

For reasons of security and performance, access tokens have a limited and usually very short lifetime. After an access token has expired, the client has to request a new one to continue using the FotoWeb API. There are 2 ways to do so:

• Repeat the authorization process
• Request a new access token using a refresh token

Refresh tokens may be obtained together with access tokens if authorization code grant type is used. Refresh tokens are not available when using implicit grant type.

A new access token is requested using a refresh token as follows:

POST https://myfotowebserver.com/fotoweb/oauth2/token
Content-Type: application/x-www-form-urlencoded
Accept: application/json


grant_type=refresh_token&refresh_token=REFRESH_TOKEN&client_id=CLIENT_ID&client_secret=CLIENT_SECRET

where

On success, the server responds as follows:

200 OK
Content-Type: application/json

with the following response body:

{
  "access_token": ACCESS_TOKEN,
  "token_type": "bearer",
  "expires_in": EXPIRES_IN_SECONDS,
  "refresh_token": REFRESH_TOKEN
}

where

The application can obtain the access token by parsing the response body.

If FotoWeb issues a new refresh token in the response, then the old refresh token (i.e. the refresh token used in the request) is no longer valid.

It is unspecified if and when FotoWeb will issue new refresh tokens when they are used to request new access tokens, so the client MUST support this case, even if it appears that FotoWeb does not issue new refresh tokens.