Custom App (OAuth 2.0 Auth) - Unable to refresh Token: Error: Invalid refresh token

Hi All,

I am new to Box, just created an application which I want to use to store files programmatically, for which I will be regenerating token by using API (https://www.box.com/api/oauth2/token), but I am getting Error

{

"error": "invalid_grant",

"error_description": "Invalid refresh token"

}

Here are the steps followed to create this app

Create New App Custom App
Authentication Method: OAuth 2.0 Auth
Redirect URI: http://0.0.0.0
Save Configuration
Then click on webhooks Tab and generate Primary Key & Secondary Key

This app does not use server authentication so no approval is needed.

In the realtime to get access_token we are refreshing token and using that as mentioned https://developer.box.com/guides/authentication/access-tokens/refresh/

I tested same by using postman, post URL: https://www.box.com/api/oauth2/token
with Json:

{"grant_type":"refresh_token","refresh_token":"<Seconday Key from Webhooks>", "client_id":"<client_id_from_configuration_tab>", "client_secret":"<Client_Secret_from_configuration_tab>"

}

The response is 400Bad Request with the following JSON

{

"error": "invalid_grant",

"error_description": "Invalid refresh token"

}

am I missing any step or is there anything wrong I did? Can you please help me with this?

Sachin Kolpuke

October 30, 2020 07:58

I able to get it working, here are the missing steps once the app is created

1st Step: Authorize and get code
https://app.box.com/api/oauth2/authorize?response_type=code&client_id=<client_id>&client_secret=<client_secret>&state=authenticated

2nd use the code in post API
post: https://app.box.com/api/oauth2/token
json: {"grant_type":"authorization_code","code":"<code_from_1st_step>", "client_id":"<client_id>", "client_secret":"<client_secret>"
}

{
"access_token": "<new_access_token>",
"expires_in": 3729,
"restricted_to": [],
"refresh_token": "<new_refresh_token>",
"token_type": "bearer"
}

We have to use this newly generated refresh token for all future refresh token steps. If anytime this broke due to no activity for 60 days then again we have to do same steps

telmo gondar

March 16, 2023 03:23

Thank you for sharing the solution.

The lack of documentation is deplorable.

Comments