RoadOpsDeveloper
Getting StartedOAuth AppsAuthorization CodeRefresh TokensProduction ReadinessOperationsCurrent UserTeamsMembersTravel PartiesDaysDay NotesSchedule ItemsEventsVenuesGuest RequestsPass TypesTicket TypesSet ListsSet List ItemsLodgingRental CarsDay FilesMCP ServerPostman Collection

Refresh Tokens

Handle rotating refresh tokens, expiration, replacement, and recovery.

Enable offline access in the app's Developer Portal settings, then request offline_access during authorization when the app needs access after the interactive session. Both steps are required. RoadOps OAuth apps use rotating refresh tokens with a 90-day absolute lifetime, a 30-day inactivity lifetime, and a 3-second reuse leeway.

Refresh

POST https://auth.roadops.app/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token&client_id=tpc_your_client_id&refresh_token=CURRENT_REFRESH_TOKEN

Regular web apps also use HTTP Basic client authentication. Public apps do not send a secret.

Atomically replace the stored refresh token whenever RoadOps returns a new one. Encrypt refresh tokens at rest, restrict access to the minimum runtime, never log them, and do not place them in browser local storage. If refresh fails because the token was replaced, expired, revoked, or reused outside the leeway, discard it and restart authorization.

A refresh token can retain or reduce the scopes from its original authorization, but it cannot add newly registered scopes. After expanding an app's scopes, update the authorization request and have the user authorize again.