# Refresh token or create new token when access\_token expired

**URL:** <https://community.particle.io/t/refresh-token-or-create-new-token-when-access-token-expired/59939>\
**Category:** iOS\
**Tags:** photon\
**Created:** [April 6, 2021, 4:26am UTC](https://community.particle.io/t/refresh-token-or-create-new-token-when-access-token-expired/59939 "2021-04-06T04:26:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![WilliamHQS](https://avatars.discourse-cdn.com/v4/letter/w/65b543/32.png) [@WilliamHQS](https://community.particle.io/u/WilliamHQS)\
**Post date:** [April 6, 2021, 4:26am UTC](https://community.particle.io/t/refresh-token-or-create-new-token-when-access-token-expired/59939/1 "2021-04-06T04:26:10Z")

</div>

I'm using two [legged authentication](https://docs.particle.io/tutorials/device-cloud/authentication/#two-legged-authentication) which work find until I get token expired.

I stored the `refresh_token` when I got the response:

```auto
{
  "token_type": "bearer",
  "access_token": "<--redacted-->",
  "expires_in": 7776000,
  "refresh_token": "<--redacted-->"
}

```

Then if the token invalid then I use `refresh_token` to get the new one.

```auto
curl https://api.particle.io/oauth/token -u "tempmon06-3459:<--redacted-->" -d grant_type= refresh_token

```

All works well, but until I have an account which doesn't login a long time(more than 90 days I think) then I got `token invalid` error again. **I think `refresh_token` has expired.** not sure if correct.

Then I changed my strategy to create new token every time the token expires by using

```auto
curl https://api.particle.io/oauth/token -u "tempmon06-3459:<--redacted-->" -d grant_type= client_credentials

```

Which works fine. Then I inject successfully the token and try to use it. I got the new token. But when setup WIFI, it fails on the last step **"X Verify device ownership"**

Like this image I found in the community.

 ![image](https://us1.discourse-cdn.com/flex026/uploads/particle/original/3X/f/5/f5fd0915db555f80628b238361a14075bcdf667f.png)

Not sure what should I do next. Does the way I create new token is wrong, or did I missed any important step?

What I am thing is when generate the new token the token doesn't know which user? If so I used this way:

> [@Clarification on access token expiration](https://community.particle.io/t/clarification-on-access-token-expiration/5461/19):
>
> Okay. So, I wasn’t exactly sure about the required params either, so I started digging into the spark-cli source code to figure it out. I found this: [https://github.com/spark/spark-cli/blob/master/js/lib/ApiClient.js#L133](https://github.com/spark/spark-cli/blob/master/js/lib/ApiClient.js#L133) Which told me all I needed to construct a curl request to illustrate the endpoint in action: curl -X POST https://api.spark.io/oauth/token \ -d 'username=\<YOUR\_PASSWORD\> \ -d 'password=\<YOUR\_PASSWORD\>' \ -d 'grant\_type=password' \ -d 'client\_id=\<WHATEVER\>' \ -d …

which is

```auto
curl -X POST https://api.spark.io/oauth/token \ 
  -d 'username=<YOUR_PASSWORD> \ 
  -d 'password=<YOUR_PASSWORD>' \ 
  -d 'grant_type=password' \
  -d 'client_id=<WHATEVER>' \
  -d 'client_secret=<WHATEVER>'

```

But still no luck.

Any help? thanks a lot!

---

<div class="post-metadata">

**Author:** ![rickkas7](https://sea2.discourse-cdn.com/flex026/user_avatar/community.particle.io/rickkas7/32/8681_2.png) [@rickkas7](https://community.particle.io/u/rickkas7)\
**Post date:** [June 18, 2021, 3:44pm UTC](https://community.particle.io/t/refresh-token-or-create-new-token-when-access-token-expired/59939/2 "2021-06-18T15:44:55Z")

</div>

Because you need to have the client ID and client secret in order to issue a refresh token, there is basically no advantage of using a refresh token. You should just create a new token if the original token expires rather than trying to use a refresh token.