# Trouble Getting Refresh Token

**URL:** <https://community.hubspot.com/t/trouble-getting-refresh-token/141206>\
**Category:** APIs & Integrations\
**Tags:** developer-tools\
**Created:** [October 16, 2025, 11:16pm UTC](https://community.hubspot.com/t/trouble-getting-refresh-token/141206 "2025-10-16T23:16:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![embkca](https://avatars.discourse-cdn.com/v4/letter/e/c2a13f/32.png) [@embkca](https://community.hubspot.com/u/embkca)\
**Post date:** [October 16, 2025, 11:16pm UTC](https://community.hubspot.com/t/trouble-getting-refresh-token/141206/1 "2025-10-16T23:16:56Z")

</div>

Hello,

I’m having troubles getting the refresh token for my API integration. On the [Manage OAuth access tokens using the v1 APIs - HubSpot docs](https://developers.hubspot.com/docs/api-reference/auth-oauth-v1/guide) page, it says all I have to do is execute the curl script below, replacing the values provided in the sample with those specific to my application.

curl --request POST \  
–url [https://api.hubapi.com/oauth/2026-03/token](https://api.hubapi.com/oauth/2026-03/token) \  
–header ‘content-type: application/x-www-form-urlencoded’ \  
–data 'grant\_type=authorization\_code&code=[code\_here]&redirect\_uri=[https://www.domain.com/redirect&client\_id=\[clientID\_here]&client\_secret=\[client\_secret\_here]](https://www.domain.com/redirect&client%5C_id=%5C%5BclientID%5C_here%5D&client%5C_secret=%5C%5Bclient%5C_secret%5C_here%5D) ’

When I replace the values and execute, I get the error response below. I am pretty sure the issue is with the code parameter.

{“status”:“BAD\_AUTH\_CODE”,“message”:“missing or unknown auth code”,“correlationId”:“REMOVED”}

The documentation says:

After a user authorizes your app and installs it into their account, the redirect URL will be appended with a code value, which you can use to [generate an access token and a refresh token](https://developers.hubspot.com/docs/api-reference/auth-oauth-v1/guide#generate-initial-access-and-refresh-tokens).

However, that isn’t quite what happened. I got redirected to a page without a query string parameter. To get the code parameter, I had to open up the Chrome dev tools and snag it from the network activity log. I fear the code may not be the correct one i’m looking for.

Any guidance would appreciated.

---

<div class="post-metadata">

**Author:** ![Berangere](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/berangere/32/220784_2.png) [@Berangere](https://community.hubspot.com/u/Berangere)\
**Post date:** [October 17, 2025, 9:15am UTC](https://community.hubspot.com/t/trouble-getting-refresh-token/141206/2 "2025-10-17T09:15:45Z")

</div>

Hi @embkca and welcome, we are delighted to have you here! 🤗  
Thanks for your detailed post on the HubSpot Community!  
The error {“status”:“BAD\_AUTH\_CODE”,“message”:“missing or unknown auth code”} typically means the authorization code is invalid or expired.

A few things to check:

- The code must be captured from the redirect URL immediately after user authorization; it’s only valid for a short time and can be used once.  
- Make sure the redirect\_uri in your token request matches exactly with the one used in your app’s authorization step.  
For reference, here’s the official HubSpot OAuth guide: “[Authentication overview](https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/overview)”.  
This documentation can also be helpful: “[Refresh an access token](https://developers.hubspot.com/docs/api-reference/auth-oauth-v1/tokens/post-oauth-v1-token)”.

Also, I’d love to consult our Top Experts: Hi [@sylvain\_tirreau](https://community.hubspot.com/t5/user/viewprofilepage/user-id/601366), @Anton and @Indra do you have other suggestions to help @embkca, please?  
Have a wonderful weekend and thanks so much!  
Bérangère

---

<div class="post-metadata">

**Author:** ![sylvain\_tirreau](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/sylvain_tirreau/32/67408_2.png) [@sylvain\_tirreau](https://community.hubspot.com/u/sylvain_tirreau)\
**Post date:** [October 17, 2025, 9:55am UTC](https://community.hubspot.com/t/trouble-getting-refresh-token/141206/3 "2025-10-17T09:55:52Z")

</div>

Hello @embkca,

You must follow this process:

- You have a script (_install.py_ for example) whose URL you provide to your app in your Hubspot developer account;
- When the user installs your app, they will arrive at this URL after authorizing your app to be installed on your portal;
- It is in this installation URL to the _install.py_ file that the code you must send back to Hubspot with the correct tokens will be inserted.

The code is still in this URL.

Are you following this procedure to retrieve the refresh and access tokens?

I do not recommend manually retrieving this code and then making a request with it. It is best to stay within the installation flow.