Refresh Token

Generates a new access token and refresh token for a user using the refresh token. The previous refresh token is invalidated upon successful exchange.

Token Lifespan and Renewal:

Exchange a valid refresh_token for a fresh access_token.
Refresh Token Expiry (data.refresh_token): Refresh tokens expire after 1–30 days (default: 1 day). If expired, the user must restart the passwordless authentication flow. Contact your Punchh representative to update this Punchh platform configuration.
Access Token Expiry (data.access_token): The newly generated access_token is valid for 5–60 minutes (default: 5 minutes). The exact remaining duration in seconds is specified in data.expires_in. Contact your Punchh representative to update this Punchh platform configuration.

Previous Token Lifecycle on Refresh

Refresh Token: The previously used refresh token is immediately invalidated (enforcing refresh token rotation) and cannot be reused.
Access Token: A new access token is issued. If the previous access token has not yet expired, it remains valid until the end of its original validity period. Mobile and web applications should immediately replace the existing access token with the newly issued access token.

For more information, see Advanced Authentication.

Headers

Accept
Type: string
required

Advertises which content types the client is able to understand
Content-Type
Type: string
required

Set this header to application/json
User-Agent
Type: string
required

For details, see User Agent.

Body·

required

application/json

client
Type: string
required

OAuth client ID provided by the business. Required to identify the client application for token refresh. The OAuth application must have the Advance Auth scope enabled.
refresh_token
Type: string
required

Refresh token that the client application can use to get new tokens without re-authenticating. You can retrieve the value of the refresh_token from the response of the Verify Token.

Responses

application/json
application/json
application/json
application/json
application/json

post/api2/password_less/refresh_token

curl https://SERVER_NAME_GOES_HERE/api2/password_less/refresh_token \
  --request POST \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header 'User-Agent: Punchh/OnlineOrder/1.0/Web/BrowserVersion/OS_Type' \
  --data '{
  "client": "CLIENT_GOES_HERE",
  "refresh_token": "REFRESH_TOKEN_GOES_HERE"
}'

Show Schema

{
  "data": {
    "access_token": "ACCESS_TOKEN_GOES_HERE",
    "token_type": "Bearer",
    "refresh_token": "REFRESH_TOKEN_GOES_HERE",
    "expires_in": 1800
  }
}

Refresh Token

Headers

Body·AdvancedAuthRefreshRequest

Responses

Body·