---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend]
keyword: [Extend, OAuth]
nav: wcp_docs
parent_url: /wcp_docs/
title: Request a New Access Token with a Refresh Token
layout: subsection
---

### Prerequisites

<a id="prereq_N10021_N1001E_N10001"></a>
-   You have [registered your API Client](/wcp_docs/zwx1518028675482.html) on the Workday Developer Site.
-   You have received a valid refresh token from the token endpoint.


### Context

<a id="context_N10028_N1001E_N10001"></a>
You can use a single POST request to exchange a refresh token for a new access token and a new refresh token.

<b>Note:</b> Refresh tokens are tied to the specific Workday user who originally authorized the application. If the username associated with the original refresh token changes, or if the user is deactivated, the refresh token becomes invalid and this request will fail.

### Steps

1.  <a id="step_N100B6_N1003B_N1001E_N10001"></a>Create a POST request to call the token endpoint.
2.  <a id="step_N100C7_N1003B_N1001E_N10001"></a>Obtain the Client ID of the API Client on the Workday Developer Site. You also need the client secret generated when you registered your API Client. If you lost your client secret, you can generate a new client secret from the Console. These values enable you to provide the proper headers to call the endpoint.
3.  <a id="step_N100D8_N1003B_N1001E_N10001"></a>Encode these values into Base64 format. Use the format `[Client ID]:[Client Secret]`. Do not add a space after the colon.
4.  <a id="step_N10051_N1002F_N1001E_N10001"></a>Build the Authorization header. Populate the header of the request with `ID [Encoded Value]`. You must add a space after ID.

    Example: For this client_id and client_secret:

    ```
    client_id=ODQ4ZDdkNzItMzhiMC00YmFmLTgyNztNzljNjM0MDlmNmY2 
    ```

    ```
    client_secret=bkmxcoyh53od9x7vfzjwomeh7j3z2pghnptixwfppyxlfxo2l64nlu3uvi4ylh15zadftapwvpbm98nak26v8jpjd36xrjyn
    ```

    The client_id concatenated with the client_secret is:

    ```
    ODQ4ZDdkNzItMzhiMC00YmFmLTgyNztNzljNjM0MDlmNmY2:bkmxcoyh53od9x7vfzjwomeh7j3z2pghnptixwfppyxlfxo2l64nlu3uvi4ylh15zadftapwvpbm98nak26v8jpjd36xrjyn
    ```

    The base64 encoded value is:

    ```
    T0RRNFpEZGtOekl0TXpoaU1DMDBZbUZtTFRneU56dE56bGpOak0wTURsbU5tWTI6YmtteGNveWg1M29kOXg3dmZ6andvbWVoN2ozejJwZ2hucHRpeHdmcHB5eGxmeG8ybDY0bmx1M3V2aTR5bGgxNXphZGZ0YXB3dnBibTk4bmFrMjZ2OGpwamQzNnhyanlu
    ```

    And the Authorization header is:

    ```
    Authorization: Basic ID T0RRNFpEZGtOekl0TXpoaU1DMDBZbUZtTFRneU56dE56bGpOak0wTURsbU5tWTI6YmtteGNveWg1M29kO
    ```

5.  <a id="step_N10075_N1002F_N1001E_N10001"></a>Build the Authorization body. Populate the body of the request with these parameters:

    -   grant_type: `refresh_token` (indicates the grant type of this token request).
    -   client_id: Use the value received at client registration.
    -   client_secret (Optional): Use the value received at client registration.
    -   refresh_token: The refresh token previously returned from the token endpoint.

    Use the <i>x-www-form-urlencoded</i> option to specify that the values will be encoded inside the URL itself. This adds a new header to specify the content-type.

6.  <a id="step_N100A3_N1002F_N1001E_N10001"></a>Send the request to the token endpoint.


### Result

<a id="result_N100AA_N1001E_N10001"></a>
The token endpoint sends this response body:

```
{
    "access_token": "7c3obrknwd6nnkxv0r64jdpbx",
    "refresh_token": "yxsiqvdkakj0tp9a4i2xe1fbg4blgrq1noqz2nt1cr4f8dfjpazw0jwe18a2wn656854pzb5vmcqnhpqspytg0cf5jlidyjgnfg",
    "token_type": "Bearer"
}
```

### Next Steps

<a id="postreq_N100B6_N1001E_N10001"></a>
The token timeout is tied to the session timeout configured for the user by the Workday administrator. When the token expires, send this request to the token endpoint (note the Authorization header used for refresh token requests):

```
POST https://auth.api.workday.com/v1/token Authorization: Basic 
```

```
ID T0RRNFpEZGtOekl0TXpoaU1DMDBZbUZtTFRneU56dE56bGpOak0wTURsbU5tWTI6YmtteGNveWg1M29kOXg3dmZ6andvbWVoN2ozejJwZ2hucHRpeHdmcHB5eGxmeG8ybDY0bmx1M3V2aTR5bGgxNXphZGZ0YXB3dnBibTk4bmFrMjZ2OGpwamQzNnhyanlu== 
```

```
grant_type=refresh_token&client_id=ODQ4ZDdkNzItMzhiMC00YmFmLTgyNzAtNzljNjM0MDlmNmY2&refresh_token=yxsiqvdkakj0tp9a4i2xe1fbg4blgrq1noqz2nt1cr4f8dfjpazw0jwe18a2wn656854pzb5vmcqnhpqspytg0cf5jlidyjgnfg
```

The token endpoint sends this response body:

```
{
    "access_token": "28tyw9mpe7huyyah7gftg4djg",
    "refresh_token": "1fndsc9ezoe4s4rbwrzzobgzw7l3os123o0qn1wckmf7zfv5o9v9r5l7cdra51e1vpv1hkbm0sqscj05eyc3gdzyfuoah94lqxw",
    "token_type": "Bearer"
}
```

The token endpoint sends both a new access token and a new refresh token. Use the new access token until it expires, then use the new refresh token to get a new access token and a new refresh token. When you registered the client, you also set the refresh token timeout. That refresh timeout begins at the first authorization step and doesn't get extended, even if you get a new refresh token. After the refresh timeout period expires, use the authorization code grant type authorization flow again to re-establish access to the REST resources.

### Related Information

[Authenticate Using the Authorization Code Grant Type](/wcp_docs/yai1528997518068.html)

[Reference: Workday Extend API Gateways and Authorization Base URLs](/wcp_docs/dlh1653340161856.html)