Refresh tokens

curl -X POST https://app.lunacal.ai/api/mcp/refresh \
  -H "Content-Type: application/json" \
  -d '{
    "clientSecret": "YOUR_CLIENT_SECRET",
    "refreshToken": "YOUR_REFRESH_TOKEN"
  }'

{
  "accessToken": "new-access-token",
  "expiresAt": "2026-10-05T15:00:00.000Z",
  "refreshToken": "new-refresh-token",
  "refreshTokenExpiresAt": "2027-10-05T14:00:00.000Z"
}

POST

api

mcp

refresh

curl -X POST https://app.lunacal.ai/api/mcp/refresh \
  -H "Content-Type: application/json" \
  -d '{
    "clientSecret": "YOUR_CLIENT_SECRET",
    "refreshToken": "YOUR_REFRESH_TOKEN"
  }'

{
  "accessToken": "new-access-token",
  "expiresAt": "2026-10-05T15:00:00.000Z",
  "refreshToken": "new-refresh-token",
  "refreshTokenExpiresAt": "2027-10-05T14:00:00.000Z"
}

Issues a new access token and refresh token. Call this when the access token’s 1-hour lifetime has passed.

Both tokens rotate on every call. The refresh token you submit is invalidated immediately — always store the new refreshToken from the response.

Body

string

required

Your MCP OAuth client secret.

string

required

The current, unused refresh token.

Response

string

New access token. Valid for 1 hour.

string

ISO 8601 timestamp when the new access token expires.

string

New refresh token. Valid for 365 days. Replaces the one you sent.

string

ISO 8601 timestamp when the new refresh token expires.

Errors

Status	Reason
`400`	`clientSecret` or `refreshToken` is missing
`400`	The client is invalid
`400`	The refresh token is invalid, expired, or already used

curl -X POST https://app.lunacal.ai/api/mcp/refresh \
  -H "Content-Type: application/json" \
  -d '{
    "clientSecret": "YOUR_CLIENT_SECRET",
    "refreshToken": "YOUR_REFRESH_TOKEN"
  }'

{
  "accessToken": "new-access-token",
  "expiresAt": "2026-10-05T15:00:00.000Z",
  "refreshToken": "new-refresh-token",
  "refreshTokenExpiresAt": "2027-10-05T14:00:00.000Z"
}

Event Types

Availability

Advanced

Teams & Workspaces

Bookings

Integrations

Workflows

Dynamic Bookings

Bookings Page

Embed

Others

Webhooks

Zapier

UTM Setup

Report Vulnerability

MCP API

Body

Response

Errors

​Body

​Response

​Errors

Body

Response

Errors