Refresh an access token

Credentials

Exchanges a refresh token for a new access token and a new refresh token. The refresh token you send stops working, so store the new one.

The refresh token identifies the seller, so the call needs no Authorization, PayMe-Partner-Key or PayMe-Merchant-Key header. If the refresh token is unknown, already used or expired, start again with POST /auth-tokens.

Hosts and the error format: Hosts, authentication and errors.

Parameters

This endpoint takes no path, query or header parameters.

Request body

Content type: application/json

The refresh token to exchange.

Field Type Required Description
refresh_token string yes The refresh_token from your last POST /auth-tokens or POST /refresh-exchanges call. Each refresh token works once.

Request example

{
  "refresh_token": "b6f0d3a2-8c41-4e5f-9a7d-2e1c0b9f4a53"
}

Code samples

curl

curl -X POST 'https://payme-store-staging.payme.io/api/refresh-exchanges' \
  -H 'Content-Type: application/json' \
  -H 'PayMe-Partner-Key: <YOUR_API_KEY>' \
  -H 'PayMe-Merchant-Key: <YOUR_API_KEY>' \
  --data-raw '{
  "refresh_token": "b6f0d3a2-8c41-4e5f-9a7d-2e1c0b9f4a53"
}'

Node.js

const response = await fetch("https://payme-store-staging.payme.io/api/refresh-exchanges", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "PayMe-Partner-Key": "<YOUR_API_KEY>",
    "PayMe-Merchant-Key": "<YOUR_API_KEY>",
  },
  body: JSON.stringify({
    "refresh_token": "b6f0d3a2-8c41-4e5f-9a7d-2e1c0b9f4a53"
  }),
});

console.log(await response.text());

Python

import requests

response = requests.post(
    "https://payme-store-staging.payme.io/api/refresh-exchanges",
    headers={
        "PayMe-Partner-Key": "<YOUR_API_KEY>",
        "PayMe-Merchant-Key": "<YOUR_API_KEY>",
    },
    json={
        "refresh_token": "b6f0d3a2-8c41-4e5f-9a7d-2e1c0b9f4a53",
    },
)

print(response.text)

PHP

<?php

$body = <<<'BODY'
{
  "refresh_token": "b6f0d3a2-8c41-4e5f-9a7d-2e1c0b9f4a53"
}
BODY;

$ch = curl_init('https://payme-store-staging.payme.io/api/refresh-exchanges');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'PayMe-Partner-Key: <YOUR_API_KEY>',
        'PayMe-Merchant-Key: <YOUR_API_KEY>',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

Responses

201 — New tokens issued. The refresh token you sent no longer works. (success)

Field Type Description
auth_token string The access token, a JWT. Send it as Authorization: Bearer <auth_token> on product and customer calls.
refresh_token string A single-use token for POST /refresh-exchanges, which returns a new pair of tokens. 
{
  "auth_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI5ZDJiNmYxMCJ9.c2lnbmF0dXJl",
  "refresh_token": "0e7c4b19-2d6a-4f83-b5e1-7a9c3d2f8b64"
}

400 — refresh_token is missing or not a string, or the body isn't valid JSON. (error)

Field Type Description
status_error_details string What went wrong. Validation messages are in Hebrew unless you send Accept-Language: en.
status_error_code integer 501 for a validation error or a body that isn't valid JSON, 999 for any other error.
validation_errors object The fields that failed validation. Each key is a field name; its value maps each failed rule to a message.
session string Trace id of the request. Quote it when you contact PayMe support. 
{
  "status_error_details": "Field validation failed.",
  "validation_errors": {
    "refresh_token": {
      "is_not_empty": "The field is required.",
      "is_string": "The value must be a string."
    }
  },
  "status_error_code": 501,
  "session": "f3a1c2b0-9e4d-11ef-8c1a-0242ac120002"
}

401 — The refresh token is unknown, already used or expired. Get a new pair with POST /auth-tokens. (error)

Field Type Description
status_error_details string What went wrong.
status_error_code integer 999.
session string Trace id of the request. Quote it when you contact PayMe support. 
{
  "status_error_details": "Unauthorized",
  "status_error_code": 999,
  "session": "f3a1c2b0-9e4d-11ef-8c1a-0242ac120002"
}

500 — Server error. Contact PayMe support and quote the session. (error)

Field Type Description
status_error_details string What went wrong.
status_error_code integer 999.
session string Trace id of the request. Quote it when you contact PayMe support.