I have Python code that issues a token API request to generate a new access token. The code works fine, returning new access and refresh tokens UNTIL the access token expires (24 hours after being issued). After that, the API responds with:
{“code”:“INVALID_ACCESS_TOKEN”,“httpStatus”:401,“message”:“Access token is missing or invalid.”,“developerMessage”:“Access token is not a valid token. Token might have expired.”,“requestId”:“ae36c2ea-0046-47e3-ba19-3acf03e28cd2”}
Attempting the token API without the authentication header gets the response:
“code”:“INVALID_ACCESS_TOKEN”,“httpStatus”:401,“message”:“Access token is missing or invalid.”,“developerMessage”:“authorization header must carry access token.”,“requestId”:“bcf33f59-fe5d-4c64-8166-f380455673cb”}
The documentation is mixed regarding whether the authentication header is required on token refresh - in the python example at the bottom of https://poynt.github.io/developer/doc/authentication-authorization.html, there is no authentication header indicated. However on https://poynt.com/docs/api/#index-index, the HTTP Headers section indicates the authentication token is always required.
So I have three questions:
-
Is the authentication token required on a token refresh API request?
-
Does token refresh actually work after the access token has expired and if so, could you provide some suggestions on what I might look at to determine why this is occurring?
-
Do I need to refresh access tokens prior to their expiration instead of expecting to be able to refresh them after expiration?
The python (3.4) code snippet that issues the token refresh request (and gets a 401) is below:
request_data = {
'grantType': 'REFRESH_TOKEN',
'refreshToken': refresh_token,
}
headers = {
'api-version': '1.2',
'Poynt-Request-Id': str(uuid4()),
'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
'Authorization': 'Bearer ' + access_token,
}
url = 'https://services.poynt.net/token/'
response = requests.post(url, headers=headers, data=request_data)
Thanks, peter