Yeah I'm getting the same issue too. It's frustrating because I looked through and am posting everything as Apple wants: { grant_type: 'refresh_token', refresh_token: myRefreshToken, redirect_uri: myRedirectUri, client_id: myClientId, client_secret: mySecretToken, } and it doesn't send back a new refresh_token in its response. And I also tried using the accessToken that's returned in the response and get a 400 error status code. I really don't know what I'm doing wrong if I'm missing something, or if Apple just has an error there.