… API Call oAuth2.0 Refresh Token issue PandaDocs

Question

I am having a problem trying to get an ACCESS_TOKEN from the REFRESH_TOKEN provided on PandaDocs API..

What are the correct parameters to send in order to get a new ACCESS_TOKEN from a refresh token?

I stored the refresh token I originally recieved when I first authenticated to upload a doc to be signed. I now want to use the refresh token to get an new access token in order to check the status of the signatures on the doc.

I am trying to get a new access token using the refresh token I stored but I keep getting grant_type is invalid.

This is my code..

    $token = '(refreshtokenhere)';
    $url = "https://app.pandadoc.com/oauth2/access_token"; 
  $useragent = 'Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.3 Safari/533.2';
        $ch = curl_init();
        $headr = array();

        $headr[] = 'Content-Type: application/json;charset=UTF-8';


        curl_setopt($ch, CURLOPT_HTTPHEADER,$headr);
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_HEADER, FALSE);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        curl_setopt($ch, CURLOPT_VERBOSE, 1);
        curl_setopt($ch, CURLOPT_USERAGENT, $useragent);

        $postfields['grant_type'] = 'refresh_token';
        $postfields['refresh_token'] = $token;
        $postfields['client_id'] = CLIENT_ID;
        $postfields['client_secret'] = CLIENT_SECRET;


        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $postfields );


        echo $ret = curl_exec($ch); // 

Answer 1

Check the API documentation. The grant_type should contain the authorisation code.

https://developers.pandadoc.com

http://tools.ietf.org/html/rfc6749

EDIT:

grant_type should be as it is shown in your code ie literal string "refresh_token".

As you spotted remove the content type header so the post fields are sent properly.

Answer 2

In that token field which value you are passing. It should contain refresh token obtained previously, not access token.