Refresh Token

POST /openapi/v1/auth/refresh

Làm mới Access Token bằng Refresh Token khi Access Token hết hạn.

Payload trước khi mã hóa:

{
  "refresh_token": "eyJhbGciO…"
}

Field	Required	Description
refresh_token	✅	JWT Refresh Token nhận từ API Login

cURL

curl --location '<base_url>/openapi/v1/auth/refresh' \
  --header 'Partner-Code: YOUR_PARTNER_CODE' \
  --header 'Content-Type: application/json' \
  --data '{
    "data": ENCRYPTED_PAYLOAD
  }'

Python

import requests

url = "<base_url>/openapi/v1/auth/refresh"

payload = {"data": "ENCRYPTED_PAYLOAD"}
headers = {
    "Partner-Code": "YOUR_PARTNER_CODE",
    "Content-Type": "application/json",
}

response = requests.post(url, headers=headers, json=payload)
print(response.text)

Go

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	url := "<base_url>/openapi/v1/auth/refresh"
	body := strings.NewReader(`{"data":"ENCRYPTED_PAYLOAD"}`)

	req, _ := http.NewRequest("POST", url, body)
	req.Header.Set("Partner-Code", "YOUR_PARTNER_CODE")
	req.Header.Set("Content-Type", "application/json")

	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()

	result, _ := io.ReadAll(resp.Body)
	fmt.Println(string(result))
}

JavaScript

const response = await fetch("<base_url>/openapi/v1/auth/refresh", {
  method: "POST",
  headers: {
    "Partner-Code": "YOUR_PARTNER_CODE",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ data: "ENCRYPTED_PAYLOAD" }),
});

const result = await response.text();
console.log(result);

Request

Headers

Name	Required	Description
Partner-Code	✅	Mã định danh Merchant (TCONNECT cung cấp)
Content-Type	✅	application/json

Body

Field	Type	Required	Description
data	string	✅	Payload đã mã hóa AES-256-CBC dạng Hexadecimal

Response

200 — Làm mới token thành công

Field	Type	Description
access_token	string	JWT mới dùng để xác thực request
expires_in	integer	Thời hạn access_token mới tính bằng giây
refresh_token	string	Refresh token mới
refresh_expires_in	integer	Thời hạn refresh_token mới tính bằng giây
token_type	string	Luôn là "Bearer"