# Alexa smart home skill account linking - Refresh Token

**URL:** <https://devforum.okta.com/t/alexa-smart-home-skill-account-linking-refresh-token/19245>\
**Category:** Questions\
**Created:** [February 5, 2022, 2:47pm UTC](https://devforum.okta.com/t/alexa-smart-home-skill-account-linking-refresh-token/19245 "2022-02-05T14:47:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rsharnagate](https://avatars.discourse-cdn.com/v4/letter/r/7ba0ec/32.png) [@rsharnagate](https://devforum.okta.com/u/rsharnagate)\
**Post date:** [February 5, 2022, 2:47pm UTC](https://devforum.okta.com/t/alexa-smart-home-skill-account-linking-refresh-token/19245/1 "2022-02-05T14:47:32Z")

</div>

Hi,

I am able to link Alexa smart home skill with Okta but facing issues while generating refresh-token.  
Every time I am getting 400 response code from auth server with following response

```auto
{
    "error": "invalid_grant",
    "error_description": "The authorization code is invalid or has expired."
}

```

The Alexa account link is happening and I am getting the expected directive in my AWS Lambda

```auto
{
	'directive': {
		'header': {
			'namespace': 'Alexa.Authorization',
			'name': 'AcceptGrant',
			'messageId': '7d00bf30-9a39-403a-bb29-442908691be2',
			'payloadVersion': '3'
		},
		'payload': {
			'grant': {
				'type': 'OAuth2.AuthorizationCode',
				'code': 'RHIbZhPmVnC...'
			},
			'grantee': {
				'type': 'BearerToken',
				'token': 'eyJraWQiOiJLYnJaVkQ0YXdqVUdyLVBXZm03MGNPUW9ramIyQ01wUlh1ODRSZF...'
			}
		}
	}
}

```

but the request is failing when I am trying to call **/token** API to get the refresh token.  
I am providing grant\_type, code, scope and redirect\_uri as a application/x-www-form-urlencoded body and providing base64 encoded ClientID:Client ID in the Authorization header.

Please guide me if I am missing something here.

Thanks  
Rakesh Sharnagate

---

<div class="post-metadata">

**Author:** ![aaronpk](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/aaronpk/32/1737_2.png) [@aaronpk](https://devforum.okta.com/u/aaronpk)\
**Post date:** [February 5, 2022, 4:47pm UTC](https://devforum.okta.com/t/alexa-smart-home-skill-account-linking-refresh-token/19245/2 "2022-02-05T16:47:09Z")

</div>

You’ll get an access token and refresh token at the same time. It sounds like you might be trying to use the authorization code twice, which would give you the error you’re seeing here.

---

<div class="post-metadata">

**Author:** ![rsharnagate](https://avatars.discourse-cdn.com/v4/letter/r/7ba0ec/32.png) [@rsharnagate](https://devforum.okta.com/u/rsharnagate)\
**Post date:** [February 5, 2022, 5:01pm UTC](https://devforum.okta.com/t/alexa-smart-home-skill-account-linking-refresh-token/19245/3 "2022-02-05T17:01:36Z")

</div>

Hey thanks for your reply.

Does that mean Alexa Skill is taking care of that? And there is no need to again call the **/token** API from AWS lambda?

Actually I want to implement Alexa Event Gateway which needs access and refresh tokens.

I am following below link

> <https://stackoverflow.com/questions/59568366/how-to-send-to-amazons-alexa-event-gateway>

---

<div class="post-metadata">

**Author:** ![aaronpk](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/aaronpk/32/1737_2.png) [@aaronpk](https://devforum.okta.com/u/aaronpk)\
**Post date:** [February 5, 2022, 5:19pm UTC](https://devforum.okta.com/t/alexa-smart-home-skill-account-linking-refresh-token/19245/4 "2022-02-05T17:19:38Z")

</div>

It’s been a while since I’ve tried this myself, but from the docs it looks like Amazon is going to take care of refreshing the access token when needed within the Alexa skill.

> **[Configure an Authorization Code Grant | Alexa Skills Kit](https://developer.amazon.com/en-US/docs/alexa/account-linking/configure-authorization-code-grant.html#tokens)**
>
> The Alexa Skills Kit supports authorization code grants for account linking in custom, smart home, video, meetings, and music skills.

I may be missing part of the picture though, someone can correct me if I’m wrong.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 8, 2024, 9:27pm UTC](https://devforum.okta.com/t/alexa-smart-home-skill-account-linking-refresh-token/19245/5 "2024-02-08T21:27:41Z")

</div>