Refresh Token

POST /auth/refresh/token

The Refresh Token endpoint is used to obtain a new access token when the existing one is about to expire or has expired. A partner would call this endpoint when they need to refresh their access token to maintain an active session with the CSL Pay platform. This is typically done in the background, allowing the partner to continue making API requests without interruption.

Types inferred from examples. This endpoint came from a Postman collection, which declares no schema — field types are read from the example values and no field is marked required.

Request body

refreshToken string

Duplicate field, please use 'refreshToken' instead.

Response 200

token string

The new access token obtained through the refresh process.
expiresIn integer

The number of seconds until the new access token expires.
refreshExpiresIn integer

The number of seconds until the refresh token expires.
refreshToken string

Duplicate field, please use 'refreshToken' instead.
tokenType string

The type of the new access token, typically 'Bearer'.

Environment

Request

curl -X POST "https://api.dev.cslpay.io/auth/refresh/token" \
  -H "Authorization: Bearer <access-token>" \
  -H "Content-Type: application/json" \
  -d '{
  "refreshToken": "eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzY2UxMDZiYS04ODIyLTQ0OWMtYWI1MS1iNjhiNTZlMGVlNzQifQ.eyJleHAiOjE3MzMyNTgxNDcsImlhdCI6MTczMzIyMjE0NywianRpIjoiYjdiYTNlZWQtZDc2NC00YmE5LWIyNGUtMzliZWIyOTUzZGE5IiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5tZ3QuY3NscGF5LmlvL3JlYWxtcy9tYXN0ZXIiLCJhdWQiOiJodHRwczovL2tleWNsb2FrLm1ndC5jc2xwYXkuaW8vcmVhbG1zL21hc3RlciIsInN1YiI6IjBmYzJjYTIxLWU3OWYtNGYyMi05MTI5LTgxNGI1NGIxMTBhMSIsInR5cCI6IlJlZnJlc2giLCJhenAiOiJhZG1pbi1jbGkiLCJzZXNzaW9uX3N0YXRlIjoiOTlhNmVmMGMtMDA1Mi00MTFmLTljOTgtOWJlNzNjM2Q0ZDExIiwic2NvcGUiOiJyb2xlcyBlbWFpbCBwcm9maWxlIiwic2lkIjoiOTlhNmVmMGMtMDA1Mi00MTFmLTljOTgtOWJlNzNjM2Q0ZDExIn0.vNuCaPhc5kqpGvGvKXo93fCxCcqsF7W-jxN_szAhNLmdMHYfvkXeMuFbsOBopoPqKfPLT8FxLbNVve4XtNxaiA"
}'

OkHttpClient client = new OkHttpClient();

String payload = """
    {
      "refreshToken": "eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzY2UxMDZiYS04ODIyLTQ0OWMtYWI1MS1iNjhiNTZlMGVlNzQifQ.eyJleHAiOjE3MzMyNTgxNDcsImlhdCI6MTczMzIyMjE0NywianRpIjoiYjdiYTNlZWQtZDc2NC00YmE5LWIyNGUtMzliZWIyOTUzZGE5IiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5tZ3QuY3NscGF5LmlvL3JlYWxtcy9tYXN0ZXIiLCJhdWQiOiJodHRwczovL2tleWNsb2FrLm1ndC5jc2xwYXkuaW8vcmVhbG1zL21hc3RlciIsInN1YiI6IjBmYzJjYTIxLWU3OWYtNGYyMi05MTI5LTgxNGI1NGIxMTBhMSIsInR5cCI6IlJlZnJlc2giLCJhenAiOiJhZG1pbi1jbGkiLCJzZXNzaW9uX3N0YXRlIjoiOTlhNmVmMGMtMDA1Mi00MTFmLTljOTgtOWJlNzNjM2Q0ZDExIiwic2NvcGUiOiJyb2xlcyBlbWFpbCBwcm9maWxlIiwic2lkIjoiOTlhNmVmMGMtMDA1Mi00MTFmLTljOTgtOWJlNzNjM2Q0ZDExIn0.vNuCaPhc5kqpGvGvKXo93fCxCcqsF7W-jxN_szAhNLmdMHYfvkXeMuFbsOBopoPqKfPLT8FxLbNVve4XtNxaiA"
    }
""";

RequestBody body = RequestBody.create(
        payload, MediaType.get("application/json"));

Request request = new Request.Builder()
        .url("https://api.dev.cslpay.io/auth/refresh/token")
        .post(body)
        .addHeader("Authorization", "Bearer <access-token>")
        .addHeader("Content-Type", "application/json")
        .build();

try (Response response = client.newCall(request).execute()) {
    if (!response.isSuccessful()) {
        throw new IOException("Unexpected status " + response.code());
    }
    System.out.println(response.body().string());
}

const response = await fetch("https://api.dev.cslpay.io/auth/refresh/token", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "refreshToken": "eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzY2UxMDZiYS04ODIyLTQ0OWMtYWI1MS1iNjhiNTZlMGVlNzQifQ.eyJleHAiOjE3MzMyNTgxNDcsImlhdCI6MTczMzIyMjE0NywianRpIjoiYjdiYTNlZWQtZDc2NC00YmE5LWIyNGUtMzliZWIyOTUzZGE5IiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5tZ3QuY3NscGF5LmlvL3JlYWxtcy9tYXN0ZXIiLCJhdWQiOiJodHRwczovL2tleWNsb2FrLm1ndC5jc2xwYXkuaW8vcmVhbG1zL21hc3RlciIsInN1YiI6IjBmYzJjYTIxLWU3OWYtNGYyMi05MTI5LTgxNGI1NGIxMTBhMSIsInR5cCI6IlJlZnJlc2giLCJhenAiOiJhZG1pbi1jbGkiLCJzZXNzaW9uX3N0YXRlIjoiOTlhNmVmMGMtMDA1Mi00MTFmLTljOTgtOWJlNzNjM2Q0ZDExIiwic2NvcGUiOiJyb2xlcyBlbWFpbCBwcm9maWxlIiwic2lkIjoiOTlhNmVmMGMtMDA1Mi00MTFmLTljOTgtOWJlNzNjM2Q0ZDExIn0.vNuCaPhc5kqpGvGvKXo93fCxCcqsF7W-jxN_szAhNLmdMHYfvkXeMuFbsOBopoPqKfPLT8FxLbNVve4XtNxaiA"
  })
});

const data = await response.json();
console.log(data);

import requests

response = requests.post(
    "https://api.dev.cslpay.io/auth/refresh/token",
    headers={
        "Authorization": "Bearer <access-token>",
        "Content-Type": "application/json"
    },
    json={
      "refreshToken": "eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzY2UxMDZiYS04ODIyLTQ0OWMtYWI1MS1iNjhiNTZlMGVlNzQifQ.eyJleHAiOjE3MzMyNTgxNDcsImlhdCI6MTczMzIyMjE0NywianRpIjoiYjdiYTNlZWQtZDc2NC00YmE5LWIyNGUtMzliZWIyOTUzZGE5IiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5tZ3QuY3NscGF5LmlvL3JlYWxtcy9tYXN0ZXIiLCJhdWQiOiJodHRwczovL2tleWNsb2FrLm1ndC5jc2xwYXkuaW8vcmVhbG1zL21hc3RlciIsInN1YiI6IjBmYzJjYTIxLWU3OWYtNGYyMi05MTI5LTgxNGI1NGIxMTBhMSIsInR5cCI6IlJlZnJlc2giLCJhenAiOiJhZG1pbi1jbGkiLCJzZXNzaW9uX3N0YXRlIjoiOTlhNmVmMGMtMDA1Mi00MTFmLTljOTgtOWJlNzNjM2Q0ZDExIiwic2NvcGUiOiJyb2xlcyBlbWFpbCBwcm9maWxlIiwic2lkIjoiOTlhNmVmMGMtMDA1Mi00MTFmLTljOTgtOWJlNzNjM2Q0ZDExIn0.vNuCaPhc5kqpGvGvKXo93fCxCcqsF7W-jxN_szAhNLmdMHYfvkXeMuFbsOBopoPqKfPLT8FxLbNVve4XtNxaiA"
    },
)

response.raise_for_status()
print(response.json())

Response

200200

{
  "token": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJoTkc3SmotWjRSX1dtNTEtcGpJWDlWTlBsNlljLUwxNHhZNzB0NDNBQkJ3In0.eyJleHAiOjE3ODY0OTQzNDUsImlhdCI6MTc4NjQ1ODM5NSwianRpIjoiOWUxY2MyODYtNmExYy00MDExLWJlOTYtZGQzYzUwYzNhOGQxIiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5tZ3QuY3NscGF5LmlvL3JlYWxtcy9tYXN0ZXIiLCJhdWQiOiJhY2NvdW50Iiwic3ViIjoiNTVkMGM1MGUtNGZiNi00NTUzLTllMWQtZTZlNmYwZGYyNzBmIiwidHlwIjoiQmVhcmVyIiwiYXpwIjoiYWRtaW4tY2xpIiwic2Vzc2lvbl9zdGF0ZSI6IjRlNmFjN2QzLTMxZTItNGUzZi05YWRhLTZhZDQzNjliZDg1NSIsImFjciI6IjEiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsiZGVmYXVsdC1yb2xlcy1tYXN0ZXIiLCJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIiwiaW10by1hZG1pbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoicm9sZXMgZW1haWwgcHJvZmlsZSIsInNpZCI6IjRlNmFjN2QzLTMxZTItNGUzZi05YWRhLTZhZDQzNjliZDg1NSIsInBob25lTnVtYmVyIjoiMjM0NzAzMzg3MjQzNSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJwYXJ0bmVyQ29kZSI6Ijc5MDU5OCIsIm5hbWUiOiJraW1iZXJsZXkgT21vd2VsZSIsInByZWZlcnJlZF91c2VybmFtZSI6ImtvbW93ZWxlQGdtYWlsLmNvbSIsImdpdmVuX25hbWUiOiJraW1iZXJsZXkiLCJmYW1pbHlfbmFtZSI6Ik9tb3dlbGUiLCJlbWFpbCI6ImtvbW93ZWxlQGdtYWlsLmNvbSIsInByb2RVc2VyIjoiZmFsc2UifQ.QFT1jbWeBp-C4RSj20od0fqxigM00ZBmrBNUqXkJSLO_gw5a57J9EOOb6N6irOudTMkfSj0Q4g3P-MVQMO1Iz-vwzZQcsunEFzfjLAhShxf14seLEnzkd94fSOYRmfuWvts3RWu3mSfrmP1DK2Z6wcz4qRk37J_hAQEdWGiAL8VVcKjFxkbtDFLPjU0P68UxdfCO6IezFmQ4XWRvaP0oBGZSM5mAi_soytQoienVbTJA-K84DiYPajx8zaQSjgRV0ITkFnLgVDtpQ89MEP0067LKSICxUcxEgbSWOQP52D7RgPeCZe7aMgZZqHrD9gLCF8c9Qzq5eAoYzvx13SaG_Q",
  "expiresIn": 35950,
  "refreshExpiresIn": 35950,
  "refreshToken": "eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzY2UxMDZiYS04ODIyLTQ0OWMtYWI1MS1iNjhiNTZlMGVlNzQifQ.eyJleHAiOjE3ODY0OTQzNDUsImlhdCI6MTc4NjQ1ODM5NSwianRpIjoiNTgxY2M1NWItN2I0Mi00MzAxLWI2MjgtNjVkNzI4ODMyMGNkIiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5tZ3QuY3NscGF5LmlvL3JlYWxtcy9tYXN0ZXIiLCJhdWQiOiJodHRwczovL2tleWNsb2FrLm1ndC5jc2xwYXkuaW8vcmVhbG1zL21hc3RlciIsInN1YiI6IjU1ZDBjNTBlLTRmYjYtNDU1My05ZTFkLWU2ZTZmMGRmMjcwZiIsInR5cCI6IlJlZnJlc2giLCJhenAiOiJhZG1pbi1jbGkiLCJzZXNzaW9uX3N0YXRlIjoiNGU2YWM3ZDMtMzFlMi00ZTNmLTlhZGEtNmFkNDM2OWJkODU1Iiwic2NvcGUiOiJyb2xlcyBlbWFpbCBwcm9maWxlIiwic2lkIjoiNGU2YWM3ZDMtMzFlMi00ZTNmLTlhZGEtNmFkNDM2OWJkODU1In0.e8JAAcJ03nmbVsX77cqpSdnCjizOdLv3_e4pg57oRa208Mh8eSaMZ2wxty1tFU7w1J646l0R9V7PCIVfz5gUpA",
  "tokenType": "Bearer"
}

Authorization

Authorization: Bearer <access-token>

Sent on every request. See Getting Started.

Try it

POST /auth/refresh/token

Requests go to your test environment only. Nothing here reaches production, and your token is forwarded once and never stored.

Environment Request URL

POST

Authorization

Sent with this request only and never stored. Use a test credential — if a proxy in front of this site blocks POST, the request is retried as an encoded URL, which edge logs can capture. Get one from Getting Started.

Request Body

JSON. Edited here, not saved.

Response

Response headers