# Exchanging Authorisation code giving everything except refresh token!

**URL:** <https://community.monzo.com/t/exchanging-authorisation-code-giving-everything-except-refresh-token/131532>\
**Category:** Developers\
**Created:** [15 April 2022 13:26 UTC](https://community.monzo.com/t/exchanging-authorisation-code-giving-everything-except-refresh-token/131532 "2022-04-15T13:26:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mtthieu](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@mtthieu](https://community.monzo.com/u/mtthieu)\
**Post date:** [15 April 2022 13:26 UTC](https://community.monzo.com/t/exchanging-authorisation-code-giving-everything-except-refresh-token/131532/1 "2022-04-15T13:26:03Z")

</div>

Hey guys! So I am currently building a script to sync my Amex transactions with my Monzo ones (after every purchase, the money will be moved into a pot!).  
However, I can’t get the Monzo API to give me back a refresh\_token! Here is the response I get:

```auto
{"access_token":"redacted","client_id":"redacted","expires_in":107999,"scope":"third_party_developer_app.pre_verification","token_type":"Bearer","user_id":"redacted"}

```

and nothing else! 😢

Here is my request:

```auto
    payload = {
        "grant_type": "authorization_code",
        "client_id": client_id,
        "client_secret": client_secret,
        "redirect_uri": "http://127.0.0.1:5000/callback",
        "code": auth_token,
    }

    response = requests.request("POST", url, data=payload)
    if not response.ok:
        get_new_monzo_auth()
        return False

    access_token = response.json()["access_token"]
    refresh_token = response.json()["refresh_token"] #FAILS!
    Data.create(key="monzo_access_token", value=access_token)
    Data.create(key="monzo_refresh_token", value=refresh_token)
    return True

```

I don’t get why this is happening!

---

<div class="post-metadata">

**Author:** ![PeteMcD](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/petemcd/32/14656_2.png) [@PeteMcD](https://community.monzo.com/u/PeteMcD)\
**Post date:** [16 April 2022 12:44 UTC](https://community.monzo.com/t/exchanging-authorisation-code-giving-everything-except-refresh-token/131532/2 "2022-04-16T12:44:40Z")

</div>

When you created the client in the Monzo developer interface what options did you select? The chances are for confidentiality you chose “Not Confidential”. The API only gives a refresh token if the “Confidential” option is chosen

![monzo-api](https://global.discourse-cdn.com/monzo/original/3X/2/b/2b0699cdb97e55f3c32396c4683ed2a99054dd9b.png)

This is mentioned in the [API documentation](https://docs.monzo.com/#authentication) but to be honest I think I have made the same mistake a few times.

> Client confidentiality
> 
> Clients are designated either confidential or non-confidential.
> 
> ```
> Confidential clients keep their client secret hidden. For example, a server-side app that never exposes its secret to users.
> 
> Non-confidential clients cannot keep their client secret hidden. For example, client-side apps that store their client secret on the user’s device, where it could be intercepted.
> 
> Non-confidential clients are not issued refresh tokens.
> 
> ```

---

<div class="post-metadata">

**Author:** ![bee](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/bee/32/63591_2.png) [@bee](https://community.monzo.com/u/bee)\
**Post date:** [16 April 2022 19:28 UTC](https://community.monzo.com/t/exchanging-authorisation-code-giving-everything-except-refresh-token/131532/3 "2022-04-16T19:28:58Z")

</div>

This is super super cool and I am going to set it up 🙏

Monzo is [hiring](https://monzo.com/careers/) if you wanted to apply too:

> **[Careers at Monzo](https://monzo.com/careers/)**
>
> Monzo are building a smart bank on your smartphone and we need your help to create the bank of the future.

again, thanks so much for this!!

---

<div class="post-metadata">

**Author:** ![mtthieu](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@mtthieu](https://community.monzo.com/u/mtthieu)\
**Post date:** [17 April 2022 13:01 UTC](https://community.monzo.com/t/exchanging-authorisation-code-giving-everything-except-refresh-token/131532/4 "2022-04-17T13:01:23Z")

</div>

No problem! By any chance, were you intending to reply to [my Amex-Monzo Script](https://community.monzo.com/t/amex-monzo-working-dynamic-synchronisation/131544)?  
I appreciate the feedback! 😄