curl https://auth.smartcar.com/oauth/token \
-X POST \
-H 'Authorization: Basic base64({client_id}:{client_secret})' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=refresh_token&refresh_token=3e565aed-d4b2-4296-9b4c-aec35825a6aa'
new_access = client.exchange_refresh_token('{refreshToken}')
newAccess = client.exchangeRefreshToken('{refreshToken}');
Auth newAccess = authClient.exchangeRefreshToken('{refreshToken}');
new_access = client.exchange_refresh_token("{refresh_token}")
{
"access_token": "cf7ba7e9-8c5d-417d-a99f-c386cfc235cc",
"token_type": "Bearer",
"expires_in": 7200,
"refresh_token": "58b128ba-8e44-11ee-b9d1-0242ac120002"
}
Vehicle Authorization & Permissions
Refreshing Access Tokens
Your access token will expire 2 hours after it is issued. When this happens, your application can retrieve a new one by using the corresponding refresh_token without requiring the user to re-authenticate.
POST
/
oauth
/
token
curl https://auth.smartcar.com/oauth/token \
-X POST \
-H 'Authorization: Basic base64({client_id}:{client_secret})' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=refresh_token&refresh_token=3e565aed-d4b2-4296-9b4c-aec35825a6aa'
new_access = client.exchange_refresh_token('{refreshToken}')
newAccess = client.exchangeRefreshToken('{refreshToken}');
Auth newAccess = authClient.exchangeRefreshToken('{refreshToken}');
new_access = client.exchange_refresh_token("{refresh_token}")
{
"access_token": "cf7ba7e9-8c5d-417d-a99f-c386cfc235cc",
"token_type": "Bearer",
"expires_in": 7200,
"refresh_token": "58b128ba-8e44-11ee-b9d1-0242ac120002"
}
The Vehicles API v2.0 will be deprecated on December 1, 2026. The latest version, v3, was introduced on August 26, 2025. We recommend migrating as soon as possible to ensure continued support and access to new features.
A refresh token is invalidated 10 minutes after use. If your first attempt at refreshing tokens fails, ensure you retry within 10 minutes.
Please ensure you’re persisting both the newly minted access and refresh token. Failure to do so will require the user to authenticate again after the access token has expired.
Request
Headersstring
default:"Basic "
required
The HTTP Authorization header using the Basic authentication scheme.To construct the Authorization header value:
- Join your
client_idandclient_secretwith a single colon (:). - Base64-encode the resulting string:
base64({client_id}:{client_secret}) - Prepend
Basic(with a trailing space) to the encoded string.
Basic bXktY2xpZW50LWlkOm15LWNsaWVudC1zZWNyZXQ=string
required
Must be set to
application/x-www-form-urlencoded, matching the format of the request body.string
required
A valid HTTP User Agent value. This value is typically included in the HTTP requests by the client that is making the request. You usually don’t have to set this manually.
curl https://auth.smartcar.com/oauth/token \
-X POST \
-H 'Authorization: Basic base64({client_id}:{client_secret})' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=refresh_token&refresh_token=3e565aed-d4b2-4296-9b4c-aec35825a6aa'
new_access = client.exchange_refresh_token('{refreshToken}')
newAccess = client.exchangeRefreshToken('{refreshToken}');
Auth newAccess = authClient.exchangeRefreshToken('{refreshToken}');
new_access = client.exchange_refresh_token("{refresh_token}")
string
required
This value must be set to
refresh_tokenstring
required
The refresh token received in the response with the access token from an auth code exchange
or prior token refresh.
string
A string representing an access token used to make requests to the Smartcar API.
number
The number of seconds the access token is valid for. This is always set to 7200 (2 hours)
string
A string representing a refresh token, which is used to renew access when the current access token expires. The refresh token expires after 60 days.
string
Always set to
Bearer.{
"access_token": "cf7ba7e9-8c5d-417d-a99f-c386cfc235cc",
"token_type": "Bearer",
"expires_in": 7200,
"refresh_token": "58b128ba-8e44-11ee-b9d1-0242ac120002"
}
Was this page helpful?