ARTIFACTORY: How to Generate and Refresh an Access Token via REST API

Introduction
This article will demonstrate how to generate a refreshable token using the JFrog Access API and outline the process of refreshing it to obtain a new token pair.

Resolution
Step-by-Step Instructions

1. Generate a Refreshable Token To create an access token that includes a refresh token, you must explicitly pass the refreshable=true parameter in your request.

curl -H "Authorization: Bearer <admin_access_token>" \
     -XPOST "https://<artifactory-url>/access/api/v1/tokens" \
     -d "refreshable=true"

Expected Output: The system will return a JSON payload containing both the access_token and the refresh_token. Keep the refresh_token secure, as it will be used when you want to refresh this token. Or you can find it later in the UI.

{
  "token_id" : "6fb92354-1aed-42f2-bd4b-1e3acfff8e30",
  "access_token" : "eyJ2ZXIiOiIyIiwidHlw...", 
  "refresh_token" : "f1782ce5-5683-444d-8c17-1f62bdace278",
  "expires_in" : 31536000,
  "scope" : "applied-permissions/user",
  "token_type" : "Bearer"
}


2. Refresh the Token When the access_token is near expiration, you can exchange the refresh_token for a brand new token pair.

Run the following curl command, making sure to specify grant_type=refresh_token and providing the refresh_token string:

curl -H "Authorization: Bearer <admin_access_token>" \
     -XPOST "https://<artifactory-url>/access/api/v1/tokens" \
     -d "grant_type=refresh_token" \
     -d "refresh_token=f1782ce5-5683-444d-8c17-1f62bdace278"

Expected Output: The Access API will revoke the old token and issue a completely new access_token and a new refresh_token.

{
  "token_id" : "eaaaa091-0d66-4bf1-ad6b-369c129b749d",
  "access_token" : "<new_value>",
  "refresh_token" : "ae68e13b-c8db-408a-865c-c9b69192ed46",
  "expires_in" : 31536000,
  "scope" : "applied-permissions/user",
  "token_type" : "Bearer"
}


Conclusion
By utilizing the refreshable=true flag and the grant_type=refresh_token parameter, you can easily build automated flows that rotate access tokens without human intervention, ensuring both continuous uptime and strict security compliance.
For more advanced token scoping (such as assigning specific groups or expiration times), please refer to the official JFrog Access Tokens API Documentation.