Token Refresh

You can refresh an authorization code token issued by the Access Token request. This is used to extend the life of the Access Token in order to prevent the InsureSign user from needing to provide their credentials again. Refresh tokens are issued only for Authorization Code clients whose authorization request included offline_access in scope.

URL

POST https://oauth.formstackservices.com/oauth2/token

Headers

Name	Value	Description
Content-Type	application/x-www-form-urlencoded
Authorization	InsureSign Integration credentials.	Clients with a UUID `client_id`, and all Client Credentials clients: Base64 encoded string of URL-encoded `client_id:client_secret`. Authorization Code clients with a non-UUID `client_id` do not send this header.

Request Fields

Path	Type	Optional	Description
grant_type	String	false	Value of `refresh_token` as required by the OAuth2 standard for token exchange.
client_id	String	false	Your InsureSign issued integration `client_id`.
refresh_token	String	false	The `refresh_token` issued during the Authorization Code / Access Token Exchange request.
client_secret	String	true	Only for Authorization Code clients with a non-UUID `client_id`; send it here instead of the Authorization header.

Response Fields

Path	Type	Description
access_token	String	The OAuth access token issued by the token exchange request. This will be used as Authorization credentials on all subsequent InsureSign API calls.
expires_in	Long	Time in seconds that the issued access token will be valid.
token_type	String	Defines the type of access token that was granted by the token exchange.

Example Request

$ curl 'https://oauth.formstackservices.com/oauth2/token' -i -X POST \
    -H 'Authorization: Basic YourEncodedClientIdAndSecret' \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d 'grant_type=refresh_token&client_id=myclientid&refresh_token=yourRefreshToken'

For Authorization Code clients with a non-UUID client_id, send the credentials in the body instead:

$ curl 'https://oauth.formstackservices.com/oauth2/token' -i -X POST \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d 'grant_type=refresh_token&client_id=myclientid&client_secret=myclientsecret&refresh_token=yourRefreshToken'

Example Response

HTTP/1.1 200 OK
Pragma: no-cache
X-XSS-Protection: 1; mode=block
Expires: 0
X-Frame-Options: DENY
Content-Length: 625
X-Content-Type-Options: nosniff
Content-Type: application/json;charset=UTF-8
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Cache-Control: no-cache, no-store, max-age=0, must-revalidate

{
  "access_token": "your access token",
  "expires_in": 3600,
  "token_type": "Bearer"
}

📘
Legacy API Endpoint
Through September 2026 these examples used https://sign-auth.insuresign.io. The browser step was GET /oauth2/authorize (the help article used /login). Token calls sent HTTP Basic. Use https://oauth.formstackservices.com with the paths and credential placement on this page. Migrated Authorization Code client IDs from that host send client_id and client_secret in the POST body.
API credentials issued before 15 January 2021 used https://auth.insuresign.io/.