---
title: "Refresh OAuth2 provider tokens"
method: POST
path: "/token/provider/{provider}"
tags: ["authentication"]
---

# Refresh OAuth2 provider tokens

`POST /token/provider/{provider}`

Refresh the OAuth2 provider access token using a valid refresh token. Returns a new provider session with updated access token, refresh token (if rotated by provider), and expiration information. This endpoint allows maintaining long-lived access to provider APIs without requiring the user to re-authenticate.

## Path parameters

- `provider` 'apple' | 'github' | 'google' | 'linkedin' | 'discord' | 'spotify' | 'twitch' | 'gitlab' | 'bitbucket' | 'workos' | 'azuread' | 'entraid' | 'strava' | 'facebook' | 'windowslive' | 'twitter', required

## Request body

- RefreshProviderTokenRequest — Request to refresh OAuth2 provider tokens
  - `refreshToken` string, required — OAuth2 provider refresh token obtained from previous authentication

## Response `200`

Successfully refreshed provider tokens

- ProviderSession — OAuth2 provider session containing access and refresh tokens
  - `accessToken` string, required — OAuth2 provider access token for API calls
  - `expiresIn` integer, required — Number of seconds until the access token expires
  - `expiresAt` string, date-time, required — Timestamp when the access token expires
  - `refreshToken` string, nullable — OAuth2 provider refresh token for obtaining new access tokens (if provided by the provider)

## Other responses

- `default` — An error occurred while processing the request

## Changes

- **2026-06-24** `0fc5fd589dbf` — 1 warning
  - added the new `otp-too-many-attempts` enum value to the `error` response property for the response status `default`
- **2026-04-20** `b39086c84b43` — 1 warning, 1 info
  - added the new `user-already-exists` enum value to the `error` response property for the response status `default`
  - removed the `email-already-in-use` enum value from the `error` response property for the response status `default`
- **2025-11-11** `484d9f1a422a` — 1 warning
  - added the new `provider-account-already-linked` enum value to the `error` response property for the response status `default`
- **2025-10-28** `ca6d11a13264` — 1 info
  - endpoint added
- **2025-10-09** `2bb5c4e40463` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/nhost/apis/nhost-authentication-api/changes/token/provider/:provider/post.md)

---

[API](https://skmtc.dev/nhost/apis/nhost-authentication-api.md) · [All operations](https://skmtc.dev/nhost/apis/nhost-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nhost/nhost-authentication-api/revisions/a5c0d88b55c4/schema)