# Refresh an access token

Building with an AI agent? Start at https://docs.payme.io/agents.md

- Sandbox: `POST https://payme-store-staging.payme.io/api/refresh-exchanges`
- Production: `POST https://payme-store.payme.io/api/refresh-exchanges`

## Credentials

- Header `PayMe-Partner-Key` (API key) and Header `PayMe-Merchant-Key` (API key)
- Request body field `refresh_token` (required): The `refresh_token` from your last `POST /auth-tokens` or `POST /refresh-exchanges` call. Each refresh token works once.

Exchanges a refresh token for a new access token and a new refresh token. The refresh token you send stops working, so store the new one.

The refresh token identifies the seller, so the call needs no `Authorization`, `PayMe-Partner-Key` or `PayMe-Merchant-Key` header. If the refresh token is unknown, already used or expired, start again with [`POST /auth-tokens`](/products-and-customers/authentication/post-auth-token).

Hosts and the error format: [Hosts, authentication and errors](/products-and-customers/authentication).

## Parameters

This endpoint takes no path, query or header parameters.

## Request body

Content type: `application/json`

The refresh token to exchange.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `refresh_token` | string | yes | The `refresh_token` from your last `POST /auth-tokens` or `POST /refresh-exchanges` call. Each refresh token works once. |

### Request example

```json
{
  "refresh_token": "b6f0d3a2-8c41-4e5f-9a7d-2e1c0b9f4a53"
}
```

## Code samples

### curl

```bash
curl -X POST 'https://payme-store-staging.payme.io/api/refresh-exchanges' \
  -H 'Content-Type: application/json' \
  -H 'PayMe-Partner-Key: <YOUR_API_KEY>' \
  -H 'PayMe-Merchant-Key: <YOUR_API_KEY>' \
  --data-raw '{
  "refresh_token": "b6f0d3a2-8c41-4e5f-9a7d-2e1c0b9f4a53"
}'
```

### Node.js

```javascript
const response = await fetch("https://payme-store-staging.payme.io/api/refresh-exchanges", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "PayMe-Partner-Key": "<YOUR_API_KEY>",
    "PayMe-Merchant-Key": "<YOUR_API_KEY>",
  },
  body: JSON.stringify({
    "refresh_token": "b6f0d3a2-8c41-4e5f-9a7d-2e1c0b9f4a53"
  }),
});

console.log(await response.text());
```

### Python

```python
import requests

response = requests.post(
    "https://payme-store-staging.payme.io/api/refresh-exchanges",
    headers={
        "PayMe-Partner-Key": "<YOUR_API_KEY>",
        "PayMe-Merchant-Key": "<YOUR_API_KEY>",
    },
    json={
        "refresh_token": "b6f0d3a2-8c41-4e5f-9a7d-2e1c0b9f4a53",
    },
)

print(response.text)
```

### PHP

```php
<?php

$body = <<<'BODY'
{
  "refresh_token": "b6f0d3a2-8c41-4e5f-9a7d-2e1c0b9f4a53"
}
BODY;

$ch = curl_init('https://payme-store-staging.payme.io/api/refresh-exchanges');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'PayMe-Partner-Key: <YOUR_API_KEY>',
        'PayMe-Merchant-Key: <YOUR_API_KEY>',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;
```

## Responses

### 201 — New tokens issued. The refresh token you sent no longer works. (success)

| Field | Type | Description |
| --- | --- | --- |
| `auth_token` | string | The access token, a JWT. Send it as `Authorization: Bearer <auth_token>` on product and customer calls. |
| `refresh_token` | string | A single-use token for `POST /refresh-exchanges`, which returns a new pair of tokens. |

```json
{
  "auth_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI5ZDJiNmYxMCJ9.c2lnbmF0dXJl",
  "refresh_token": "0e7c4b19-2d6a-4f83-b5e1-7a9c3d2f8b64"
}
```

### 400 — `refresh_token` is missing or not a string, or the body isn't valid JSON. (error)

| Field | Type | Description |
| --- | --- | --- |
| `status_error_details` | string | What went wrong. Validation messages are in Hebrew unless you send `Accept-Language: en`. |
| `status_error_code` | integer | `501` for a validation error or a body that isn't valid JSON, `999` for any other error. |
| `validation_errors` | object | The fields that failed validation. Each key is a field name; its value maps each failed rule to a message. |
| `session` | string | Trace id of the request. Quote it when you contact PayMe support. |

```json
{
  "status_error_details": "Field validation failed.",
  "validation_errors": {
    "refresh_token": {
      "is_not_empty": "The field is required.",
      "is_string": "The value must be a string."
    }
  },
  "status_error_code": 501,
  "session": "f3a1c2b0-9e4d-11ef-8c1a-0242ac120002"
}
```

### 401 — The refresh token is unknown, already used or expired. Get a new pair with `POST /auth-tokens`. (error)

| Field | Type | Description |
| --- | --- | --- |
| `status_error_details` | string | What went wrong. |
| `status_error_code` | integer | `999`. |
| `session` | string | Trace id of the request. Quote it when you contact PayMe support. |

```json
{
  "status_error_details": "Unauthorized",
  "status_error_code": 999,
  "session": "f3a1c2b0-9e4d-11ef-8c1a-0242ac120002"
}
```

### 500 — Server error. Contact PayMe support and quote the `session`. (error)

| Field | Type | Description |
| --- | --- | --- |
| `status_error_details` | string | What went wrong. |
| `status_error_code` | integer | `999`. |
| `session` | string | Trace id of the request. Quote it when you contact PayMe support. |