Last updated November 2, 2026

Refresh a User Access Token

Although the fetched access_token expires within 2 hours, it can be refreshed without user consent. The developer's backend server can schedule background jobs to keep tokens up to date.

Refresh tokens are rotated: a successful refresh request will return a new refresh_token in place of the one you sent. The previous refresh token stops working once a new one is issued. Always save the refresh_token from the most recent response and use it in your next refresh request.

Endpoint

HTTP URL	`https://open.tiktokapis.com/v2/oauth/token/`
HTTP method	`POST`
Scopes	`None`
Content type	`application/x-www-form-urlencoded`

Request

Send all parameters as URL-encoded form data in the request body.

Headers

Field	Type	Description	Required
`Content-Type`	`string`	The media type of the request body. Must be `application/x-www-form-urlencoded`.	Yes

Request body

Field	Type	Description	Required
`client_key`	`string`	The client key from your app's App credentials section.	Yes
`client_secret`	`string`	The client secret from your app's App credentials section.	Yes
`grant_type`	`string`	The OAuth grant type. Must be `refresh_token`.	Yes
`refresh_token`	`string`	The user's most recent refresh token.	Yes

Request example

curl --location --request POST 'https://open.tiktokapis.com/v2/oauth/token/' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Cache-Control: no-cache' \
--data-urlencode 'client_key=CLIENT_KEY' \
--data-urlencode 'client_secret=CLIENT_SECRET' \
--data-urlencode 'grant_type=refresh_token' \
--data-urlencode 'refresh_token=REFRESH_TOKEN'

Response

A successful request returns the following fields as JSON. Replace all stored values for the user, including the refresh token.

Response body

Field	Type	Description
`access_token`	`string`	The new access token for API calls on behalf of the user.
`expires_in`	`int64`	The number of seconds until the new access token expires.
`refresh_token`	`string`	The refresh token to use for the next refresh. Can differ from the `refresh_token` in the request, because refresh tokens are rotate: a successful refresh request returns a new `refresh_token` in place of the one you sent, immediately invalidating the previous token.
`refresh_expires_in`	`int64`	The number of seconds until the refresh token expires. The refresh token is valid for 180 days after the initial issuance.
`open_id`	`string`	The TikTok user's unique identifier.
`scope`	`string`	A comma-separated list of the scopes the user authorized.
`token_type`	`string`	The token type. Always `Bearer`.

Make sure to store these values on your backend as they are needed to persist access.

Example

If the request is successful, the response will look like the following.

{
    "access_token": "act.example12345Example12345Example",
    "expires_in": 86400,
    "open_id": "asdf-12345c-1a2s3d-ac98-asdf123as12as34",
    "refresh_expires_in": 31536000,
    "refresh_token": "rft.example12345Example12345Example",
    "scope": "user.info.basic,video.list",
    "token_type": "Bearer"
}

If the request is not successful, an error response body will be returned, like the following.

{
    "error": "invalid_request",
    "error_description": "The request parameters are malformed.",
    "log_id": "202206221854370101130062072500FFA2"
}

Refresh a User Access Token

#Endpoint

#Request

#Headers

#Request body

#Request example

#Response

#Response body

#Example