> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cdp.coinbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Coinbase App OAuth2 Tokens

Coinbase uses an optional security feature of OAuth2 called refresh tokens, if the scope `offline_access` was requested in the authorize (`oauth2/auth`) request.

When you first authenticate, your app is given an `access_token` and a `refresh_token`. The access token authenticates all your requests; but **the access token expires in one hour**. Once expired, you must use the refresh token to obtain a new access token and a new refresh token.

**The refresh token expires after 1.5 years**; and it can only be exchanged once for a new set of access and refresh tokens. If you try to make a call with an expired access or refresh token, a `401` response is returned.

<Warning>
  Tokens

  Use the refresh token to request a new access token *and* a new refresh token:

  * Access tokens expire in one hour.
  * Refresh tokens expire after 1.5 years and can only be exchanged once.
</Warning>

This process adds some complexity for Coinbase App integrations, but provides an valuable layer of security since a compromised access token is automatically revoked after one hour.

## Refreshing Access & Refresh Tokens

To get a new access token, you must send a POST request to `/oauth2/token` with your `refresh_token` and change the `grant_type` to `refresh_token`.

<Warning>
  There were changes to OAuth2 on [March 27, 2024](/coinbase-app/introduction/changelog#2024-mar-27).
</Warning>

The `code` and `redirect_uri` parameters are not required for this request.

```shell lines wrap theme={null}
curl https://login.coinbase.com/oauth2/token \
  -X POST \
  -d 'grant_type=refresh_token&
      client_id=YOUR_CLIENT_ID&
      client_secret=YOUR_CLIENT_SECRET&
      refresh_token=REFRESH_TOKEN'
```

The expected result is a response containing the access token, as before:

```json lines wrap theme={null}
{
  "access_token": "...",
  "token_type": "bearer",
  "expires_in": 3600,
  "refresh_token": "...",
  "scope": "all"
}
```

<Tip>
  If you are using an OAuth2 library that supports refresh tokens, the library automatically takes care of these details.
</Tip>

## Revoking an Access Token

Access tokens can be revoked manually if you want to disconnect your application's access to the user's account. Revoking can also be used to implement a log-out feature. Revoking the current access token also invalidates its paired refresh token. You must supply the current access token twice, once to revoke it, and another to authenticate the request (either containing `access_token` parameter or `Authentication` header with bearer token). `200 OK` is returned for both successful and unsuccessful requests.

```shell lines wrap theme={null}
curl https://login.coinbase.com/oauth2/revoke \
  -X POST \
  -d 'token=ACCESS_TOKEN&
      client_id=YOUR_CLIENT_ID&
      client_secret=YOUR_CLIENT_SECRET'
  -H 'Authorization: Bearer 6915ab99857fec1e6f2f6c078583756d0c09d7207750baea28dfbc3d4b0f2cb80'
```