# Invalid Client on Refresh Token

**URL:** <https://integration.keap.com/t/invalid-client-on-refresh-token/67516>\
**Category:** API Q&A\
**Created:** [April 12, 2019, 8:51pm UTC](https://integration.keap.com/t/invalid-client-on-refresh-token/67516 "2019-04-12T20:51:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vesh\_RedoxPeople.com](https://avatars.discourse-cdn.com/v4/letter/v/278dde/32.png) [@Vesh\_RedoxPeople.com](https://integration.keap.com/u/Vesh_RedoxPeople.com)\
**Post date:** [April 12, 2019, 8:51pm UTC](https://integration.keap.com/t/invalid-client-on-refresh-token/67516/1 "2019-04-12T20:51:30Z")

</div>

I am unable to get a refrsh token. It says invalid client.

$client\_id = ‘’;  
$client\_secret = ‘’;  
$old\_token = ‘’;  
$authorization = "Basic " + base64\_encode($client\_id + ‘:’ + $client\_secret);

//extract data from the post  
//set POST variables  
$url = ‘[https://api.infusionsoft.com/token](https://api.infusionsoft.com/token)’;  
$fields = array(  
‘grant\_type’=\>‘refresh\_token’,  
‘refresh\_token’=\>$old\_token,  
);

//url-ify the data for the POST  
$fields\_string = ‘’;  
foreach($fields as $key=\>$value) { $fields\_string .= $key.‘=’.$value.‘&’; }  
rtrim($fields\_string, ‘&’);

//open connection  
$ch = curl\_init();

//set the url, number of POST vars, POST data  
curl\_setopt($ch,CURLOPT\_URL, $url);  
curl\_setopt($ch, CURLOPT\_HTTPHEADER, array(‘Content-Type: application/x-www-form-urlencoded’, ‘Authorization: $authorization’));  
curl\_setopt($ch,CURLOPT\_POST, count($fields));  
curl\_setopt($ch,CURLOPT\_POSTFIELDS, $fields\_string);

//execute post  
$tokendata = curl\_exec($ch);

//close connection  
curl\_close($ch);

---

<div class="post-metadata">

**Author:** ![John\_Borelli](https://sea1.discourse-cdn.com/flex019/user_avatar/integration.keap.com/john_borelli/32/11880_2.png) [@John\_Borelli](https://integration.keap.com/u/John_Borelli)\
**Post date:** [April 14, 2019, 2:48pm UTC](https://integration.keap.com/t/invalid-client-on-refresh-token/67516/2 "2019-04-14T14:48:05Z")

</div>

Once you request a refresh BOTH the access and refresh tokens you have become invalid and you must REPLACE them with the new. You cannot re-use previously used refresh tokens. They are invalid the moment you get a new set. You must maintain them in a database and cycle them out once used. The access token is good for 24 hours so to maintain them you must run a refresh with the refresh token before it expires or at least use the refresh token before it expires in 90 days (might be six months now?).

[![](https://us1.discourse-cdn.com/flex019/uploads/infusionsoft1/original/2X/6/636d9b0c40071bb3385c3bbf0995d6c5fd9b1be5.jpeg "Using OAuth2 and Infusionsoft API/REST") ](https://www.youtube.com/watch?v=zjS8tCmnkBs)