After renewing an Access Token refresh token is revoked automatically.

[Yakiv Stoikov]

For example I have refresh token #1. When I make request:

POST https://oauth.accounting.sage.com/token
Content-Type: application/x-www-form-urlencoded
Accept: application/json

client_id=xxxxxxx
&client_secret=xxxxxxxxxx
&grant_type=refresh_token
&refresh_token=refresh_token_#1

I get response with new access and refresh token. But when I make request for renewing an Access Token again, I get:

"error": "invalid_grant",
"error_description": "the submitted refresh_token is invalid"

I need to change refresh token after 5 minutes too. It's very strange behavior.

[Steel, Mark]

Hi Yakiv, thanks for your question.

To clarify, the access_token lasts for 5 mins as you state and then needs to be renewed by exchanging the refresh token you received with the expired access_token.

There is some script in our POSTMAN Demo Data collection that keeps an environment variable up to date with the expiry time of the access token and then if expired will exchange the refresh_token for a new access_token.

Please let us know if you require additional guidance.

Thanks
Mark