How do I refresh my OAuth2 access token?

The short answer

You do not refresh. The Firsty API uses the OAuth2 client_credentials grant. There is no refresh token. When your access token is near expiry, request a new one.

Recommended pattern

1. Cache the token in memory with its

   expires_at

   timestamp
2. Before each API call, check if the token expires within the next 60 seconds
3. If yes, re-request before making the call
4. If no, use the cached token

typescript
async function getToken() {
  if (cached && cached.expiresAt > Date.now() + 60_000) {
    return cached.token;
  }
  const r = await fetch(`${BASE}/oauth/token`, {
    method: "POST",
    body: new URLSearchParams({
      grant_type: "client_credentials",
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
    }),
  });
  const json = await r.json();
  cached = { token: json.access_token, expiresAt: Date.now() + json.expires_in * 1000 };
  return cached.token;
}

What not to do

• Do not request a new token on every API call. You will get rate-limited.
• Do not store the token longer than its lifetime (1 hour).
• Do not share tokens across customer accounts. One token per client_id.