---
updatedAt: 2026-08-04T10:52:11.000Z
---

# /Generate or Refresh Token

# Generate or Refresh Token

This method creates or refreshes the token depending on the body of the request.

For creating new token required parameters are: `grant_type`, `auth_req_id`, and `client_id`

For refreshing existing token required parameters are: `grant_type`, `refresh_token`, `client_id`

### Body Parameters

parameter should be passed in Body as `x-www-form-urlencoded` parameters

<Table align={["left","left","left"]}>
  <thead>
    <tr>
      <th>
        Parameter
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        client_id
      </td>

      <td>
        string
      </td>

      <td>
        The client identifier issued to the client during the registration process
      </td>
    </tr>

    <tr>
      <td>
        auth_req_id
      </td>

      <td>
        string
      </td>

      <td>
        It is the unique identifier to identify the authentication request (transaction) made by the Client<br />NOTE - this parameter is only used in case of CIBA
      </td>
    </tr>

    <tr>
      <td>
        grant_type
      </td>

      <td>
        string
      </td>

      <td>
        When creating new token grant_type must be 'urn:openid:params:grant-type:ciba' or 'authorization_code', depending from where process was started.

        If authorization initiated from authorize endpoint then the grant_type must be 'authorization_code'.<br />If authorization initiated from bc authorization endpoint, then the grant_type must be 'urn:openid:params:grant-type:ciba'

        For refresh token grant_type must be 'refresh_token'
      </td>
    </tr>

    <tr>
      <td>
        code-verifier
      </td>

      <td>
        string
      </td>

      <td>
        The code verifier for the PKCE request, that the app originally generated before the authorization request.<br />NOTE - this parameter is skipped in case of CIBA
      </td>
    </tr>

    <tr>
      <td>
        code
      </td>

      <td>
        string
      </td>

      <td>
        The client will send the authorization code it obtained in the redirect<br />NOTE - this parameter is skipped in case of CIBA
      </td>
    </tr>

    <tr>
      <td>
        refresh_token
      </td>

      <td>
        string
      </td>

      <td>
        refresh_token parameter used when refreshing the token
      </td>
    </tr>

    <tr>
      <td>
        redirect_uri
      </td>

      <td>
        string
      </td>

      <td>
        The redirect URL that was used in the initial authorization request<br />NOTE - this parameter is skipped in case of CIBA
      </td>
    </tr>
  </tbody>
</Table>