Skip to main content

 I'm making an application that requires user authentication by OAuth to perform certain actions, and well to avoid the problem of the user having to repeat the OAuth multiple times, I can use the Refresh Token, but reading I saw that they combined the use of the same endpoint that returns the code in the OAuth flow with that of the Refresh Token

But there's a problem, it redirects me here:
https://developers.figma.com/docs/rest-api/authentication/#refresh-oauth-token

And this page only covers the OAuth flow. There are no examples or explanations of how to use the same endpoint for this flow to use the Refresh Token and get a new one. By the way, the page doesn't even mention the refresh token's validity period. The only thing they mention at the end of the document is that the access token lasts 24 hours. It's confusing because I don't know if it's just the one generated manually on the page or both (it would be good to clarify that). I'd like to know if there's any official documentation that I'm not seeing on how to use this endpoint for the refresh token, in case I'm not seeing it. Thanks in advance.

Same problem. Although, some experimenting has shown the following parameters working for refreshing the token (same POST request as for initial token request, just different body):

refresh_token=:refresh_token&grant_type=refresh_token
 
It’s a real shame they haven’t fixed the docs since May...

Regarding Refresh Token’s validity period, in theory it should be valid while you keep getting new tokens within their validity window. I.e. if the last access token expires and you didn’t get a new one, the refresh token expires too. For example, when I request an access token, I usually receive one that’s valid for ~2.5 hours, so to keep my access alive I have to refresh the token each 2.5 hours. But this is just my guess based on what would be logical.

Well, I managed to get an access token from here at figma that had a duration of 30 days, so it makes me seriously wonder how long the refreshtoken is valid and if it is renewed when used, that would be strange.

Terms & ConditionsCookie settingsAccessibility statement