Refresh tokens

Access tokens are short-lived. To maintain access to a user’s resources without asking them to authorize the connection again, include the offline scope in the /oauth2/auth request. All TPPs are granted this scope by default.

When the offline scope is included, the token response contains a refresh_token field:


{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "xRxGGEpVawiUak6He367W3oeOfh...",
  "scope": "PSP_AI offline"
}

Exchange a refresh token for a new access token by calling the token endpoint:


POST https://auth.openbanking.prod.lunar.app/oauth2/token
Content-Type: application/x-www-form-urlencoded
Authorization: Basic <base64(client_id:client_secret)>
 
grant_type=refresh_token&refresh_token=<REFRESH_TOKEN>

The response includes a new access token and may include a new refresh token.

Refresh tokens enable long-lived access for use cases such as recurring account aggregation or scheduled payments, where the user should not need to re-authenticate frequently.

Refresh tokens are valid for 180 days. This means the associated user consent is valid for 180 days before it needs to be renewed.