Refresh Tokens Flow

When an application completes the Authorization Code Flow with PKCE, ZoomInfo returns both an access token and a refresh token.

Access tokens are short-lived and must be renewed after they expire. Instead of requiring the user to re-authorize the application, you can use the refresh token to obtain a new access token.

For enhanced security, ZoomInfo uses refresh token rotation. Each refresh token can be used only once. When you exchange a refresh token for a new access token, ZoomInfo also returns a new refresh token and immediately invalidates the previous one.

Always store the latest refresh token returned by the token endpoint and use it for future token refresh requests.

Exchange Refresh Token for Access Token

Use the refresh token to obtain a new access token when the current access token expires.

To refresh an access token, send a POST request to the token endpoint with your application's credentials and the refresh token. You can provide client credentials in one of two ways:

1. HTTP Basic Authentication (recommended)
2. Request body parameters

HTTP Basic Authentication is the preferred method because it keeps client credentials separate from the request payload. If credentials are provided in both the Authorization header and the request body, the credentials in the Authorization header take precedence, and the request body values are ignored.

POST https://api.zoominfo.com/gtm/oauth/v1/token
Authorization: Basic *********************************
Content-Type: application/x-www-form-urlencoded
Accept: application/json
grant_type=refresh_token&
refresh_token=7PV7YVxG0UswgzFFaX-mDMoVRIgN5WEfLS0hfx9qSDo

POST https://api.zoominfo.com/gtm/oauth/v1/token
Content-Type: application/x-www-form-urlencoded
Accept: application/json
grant_type=refresh_token
client_id=0oaf6t3osgvaPvy4E1d7&
client_secret=***************************

The following parameters are required for each token exchange request

Upon successful verification of the external client's refresh token, ZoomInfo's authorization server will respond with a new access token. The response will always be encoded in the application/json content type.

  {
  "access_token": "eyJraWQiOiJKdThxUW1tTUx1SG9QSEFVQlJnUmh...",
  "expires_in": 1000,
  "id_token": "eyJraWQiOiJKdThxUW1tTUx1SG9QSEFVQlJnUmhCUxqHWQpbUXU0TTuzrQilNW...",
  "refresh_token": "7PV7YVxG0UswgzFFaX-mDMoVRIgN5WEfLS0hfx9qSDo",
  "scope": "api:data:company api:data:contact api:audience:read...",
  "token_type": "Bearer"
  }