CODEWITHSUNDEEP
oauthdocusignapi
Ollie Atkins
Ollie Atkins

Reputation: 153

How do I request a new refresh token when the last one expired?

I have two accounts for docusign, live and demo. The demo one hasn't been used in a while, in fact the last time a refresh token was created was the 14th November. I'm therefore assuming it has expired and is potentially stopping me from getting a new one.

When I make a request I get the invalid_grant error. The same code (with testing credentials) works fine with my live account which requests a live token every couple of days or so. It also did work fine on with the testing credentials until it wasn't used for a prolonged period.

I assumed I need to get hold of a new refresh token but without a valid previous token I'm not sure how to go about this.

Upvotes: 3

Views: 7427

Answers (2)

John Hanley
John Hanley

Reputation: 81376

You cannot refresh a Refresh Token if the Refresh Token has expired or otherwise been revoked. You must repeat the authentication flow to obtain a new Refresh Token.

Upvotes: 5

Larry K
Larry K

Reputation: 49114

The following applies to DocuSign's OAuth2 authentication service:

When you use the refresh token to get a new access token, you also get a new refresh token. But see the following:

If your original OAuth request only included the signature scope then the expiration date of the new refresh token will be the same as the original refresh token (30 days).

However, if you request both the signature and extended scopes, then your new refresh token will expire 30 days from the time that you refreshed it.

So the way you can continue to get a new access token without requiring the user to authenticate again is:

  1. User authenticates with the signature and extended scopes. Your app exchanges the auth code for an access token (good for 8 hours) and a refresh token (good for 30 days).
  2. Within the 30 day period, refresh the access token. This also gives you a new refresh token, good for a new 30 day period.
  3. Rinse and repeat. As long as you get a new refresh token at least every 30 days, you can keep going forever.

Caveat: For InfoSec reasons, the end user, their admin, and/or DocuSign might invalidate all existing refresh tokens. This is an unusual corner case but can happen. Easiest way to test the corner case: remove the user's consent for the app.

Upvotes: 5

Related Questions