Refresh tokens

Access tokens are short-lived. To maintain access to a user’s resources without asking them to authorize the connection again, include the offline scope in the /oauth2/auth request. All TPPs are granted this scope by default.

When the offline scope is included, the token response contains a refresh_token field:

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "xRxGGEpVawiUak6He367W3oeOfh...",
  "scope": "PSP_AI offline"
}

Exchange a refresh token for a new access token by calling the token endpoint:

POST https://auth.openbanking.prod.lunar.app/oauth2/token
Content-Type: application/x-www-form-urlencoded
Authorization: Basic <base64(client_id:client_secret)>
 
grant_type=refresh_token&refresh_token=<REFRESH_TOKEN>

The response includes a new access token and may include a new refresh token.

Refresh tokens are valid for 180 days. This means the associated user consent is valid for 180 days before it needs to be renewed. For consent renewal on shared Lunar Business accounts, see the Open Banking FAQ.