Authentication

Refresh Access Token

POST /v1/oauth/token

Use a valid refresh_token to obtain a new access token without re-supplying credentials.

🔄 HitchPay rotates refresh tokens on use — always store the new refresh_token from each response and discard the old one.

Request

Body Parameters

Parameter	Type	Required	Description
`grant_type`	string	✅	Must be `refresh_token`
`refresh_token`	string	✅	The refresh token from a previous token response

Code Samples

const axios = require("axios");
const qs = require("querystring");

const response = await axios.post(
  "https://sandbox.hitchpay.ng/v1/oauth/token",
  qs.stringify({
    grant_type: "refresh_token",
    refresh_token: process.env.REFRESH_TOKEN
  }),
  {
    headers: {
      "Content-Type": "application/x-www-form-urlencoded"
    }
  }
);

console.log(response.data);

<?php

$ch = curl_init();

curl_setopt_array($ch, [
  CURLOPT_URL => "https://sandbox.hitchpay.ng/v1/oauth/token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_POST => true,
  CURLOPT_POSTFIELDS => http_build_query([
    "grant_type"    => "refresh_token",
    "refresh_token" => "YOUR_REFRESH_TOKEN"
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/x-www-form-urlencoded"
  ]
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

import requests

url = "https://sandbox.hitchpay.ng/v1/oauth/token"

data = {
    "grant_type": "refresh_token",
    "refresh_token": "YOUR_REFRESH_TOKEN"
}

response = requests.post(url, data=data)
print(response.json())

Response

200 — Success

{
  "status": "success",
  "message": "Access token refreshed",
  "data": {
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "token_type": "Bearer",
    "expires_in": 3600,
    "refresh_token": "687f85a4146464a3e9ad9dd0254be4b6d25040368a5d79d2177d370a57fe2354..."
  }
}

401 — Invalid Refresh Token

{
  "status": "error",
  "code": "INVALID_CLIENT",
  "message": "Invalid Refresh Token"
}

Questions? Email [email protected]. Also on GitBook.