Once the access_token has reached its expiration date, you won’t be able to access Qonto API with it. You should request a new one by calling the /oauth2/token endpoint with your refresh_token. Don’t forget to store your new refresh_token as the previous one will be invalidated 👉 you will need it for the next refresh.

​
Body parameters

The call to POST https://oauth.qonto.com/oauth2/token must contains the following body parameters:
​
refresh_token
string
required
The token received when requesting the access token or with the last refresh call.

Please note that your refresh token remains valid within a grace period of 60 seconds after its first usage, allowing multiple usages without immediate invalidation. When the grace period ends, the refresh token will be invalidated. This can be beneficial in scenarios where network issues or delayed token exchanges may otherwise disrupt session continuity.
​
client_id
string
required
Unique identifier of your application. The value will be provided by Qonto after you fulfill the initial registration form.
​
client_secret
string
required
Secret value created by Qonto and sent to you after you fulfill the initial registration form.
​
grant_type
string
required
Type of token you are requesting.

At this step, it must be refresh_token.
Content type must be application/x-www-form-urlencoded
This call must be performed on your backend as you should never expose the client client_secret.

​
Response

{
  "access_token": "_ACCESS_TOKEN_",
  "expires_in": 3600,
  "id_token": "_TOKEN_",
  "refresh_token": "_REFRESH_TOKEN_",
  "scope": "openid offline_access organization.read",
  "token_type": "bearer"
}