Hi,  As you said Refresh Tokens do not expire the way that Access Tokens do.   I got:  string(92) "{"error_description":"unknown, invalid, or expired refresh token","error":"invalid_grant"} "   My code is:  function refreshToken($refreshToken, $clientId, $clientSecret) { $ch = curl_init(); $base = 'https://idfed.constantcontact.com/as/token.oauth2'; $url = $base . '?refresh_token=' . $refreshToken . '&grant_type=refresh_token'; curl_setopt($ch, CURLOPT_URL, $url); $auth = $clientId . ':' . $clientSecret; $credentials = base64_encode($auth); $authorization = 'Authorization: Basic ' . $credentials; curl_setopt($ch, CURLOPT_HTTPHEADER, array($authorization)); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $result = curl_exec($ch); curl_close($ch); return $result; } $refreshToken = "xxxxxx"; $clientId="xxxxxxxx"; $clientSecret="xxxxxxxx"; var_dump(refreshToken($refreshToken, $clientId, $clientSecret)); ... View more

Yes, I tried the OAuth2.0 Server Flow also. As you mentioned, we use the Refresh Token to get a new Access Token. This will also expire. In step 4, we can generate Access Token and a Refresh Token using Authorization Code. And when the Access Token expired using the Refresh Token we can regenerate new Access Token and refresh token.   That is time to time Access Token get expired and using the refresh token we generate new access token.   So time to time I have to change the code. Right? ... View more