title: Microsoft-Graph refresh-token request fails... AADSTS70000
body: <p>I am using league/oauth client with guzzle in a Slim3 WebApp working with Microsoft Graph... and I am not able to successfully request a new token by given refresh token...</p>
  
  <p>this is my di-container for league/oauth-client:</p>
  
  <pre class="lang-php prettyprint-override"><code>$container['oauthprovider'] = function ()
  {
    $provider = new \League\OAuth2\Client\Provider\GenericProvider(
      [
        'clientId' =&gt; getenv('ENV_CLIENT_ID'),
        'clientSecret' =&gt; getenv('ENV_CLIENT_SECRET'),
        'redirectUri' =&gt; getenv('ENV_REDIRECT_URL'),
        'urlAuthorize' =&gt; getenv('ENV_AUTHORIZE_URL'),
        'urlAccessToken' =&gt; getenv('ENV_URL_ACCESS_TOKEN'),
        'urlResourceOwnerDetails' =&gt; '',
        'scopes' =&gt; 'offline_access user.read people.read user.read.all openid mail.send'
      ]
    );
    return $provider;
  };
  </code></pre>
  
  <p>Works fine - in my Slim3-Route after redirect I got all tokens, refresh_token, etc.</p>
  
  <pre class="lang-php prettyprint-override"><code>$provider = $this -&gt; oauthprovider;
  $CODE = filter_var($_GET['code'], FILTER_SANITIZE_FULL_SPECIAL_CHARS);
  $accessToken = $provider -&gt; getAccessToken('authorization_code',
      ['code' =&gt; $CODE]
  );
  
  ...
  
  $existingAccessToken = $accessToken -&gt; getToken();
  $refreshToken = $accessToken -&gt; getRefreshToken();
  $expiresIn = $accessToken -&gt; getExpires();
  $expired = ($accessToken -&gt; hasExpired() ? true : false);
  $client = $this -&gt; guzzzle;
  
  ...
  </code></pre>
  
  <p>And if I try to refresh my token at this point - in the same Slim3-route - it is working fine:</p>
  
  <pre class="lang-php prettyprint-override"><code>$newAccessToken = $provider -&gt; getAccessToken('refresh_token', [
      'refresh_token' =&gt; $accessToken -&gt; getRefreshToken(),
      'grant_type' =&gt; 'refresh_token'
  ]);
  </code></pre>
  
  <p>But this is not my goal - I have to refresh the token by reaching the expired lifetime - 1 hour - in another Slim3-Route:</p>
  
  <pre class="lang-php prettyprint-override"><code>$accessToken =  unserialize($session -&gt; get('serialized_token'));
  $refreshToken = unserialize($session -&gt; get('serialized_refresh_token'));
  $code = $session -&gt; get('code');
  $provider = $this -&gt; oauthprovider;
  $client = $this -&gt; guzzzle;
  
  ...
  
  $req = $client -&gt; request('POST', 
      'https://login.windows.net/common/oauth2/token', [
      'form_params' =&gt; [
      'accept' =&gt; 'application/json',
      'grant_type'=&gt; 'refresh_token',
      'client_id' =&gt; getenv('ENV_CLIENT_ID'),
      'client_secret' =&gt; getenv('ENV_CLIENT_SECRET'),
      'refresh_token' =&gt; (string) $refreshToken,
      'redirect_uri' =&gt; getenv('ENV_REDIRECT_URL')
    ]
  ]);
  </code></pre>
  
  <p>The Response:</p>
  
  <blockquote>
    <p>Client error: <code>POST https://login.windows.net/common/oauth2/token</code> resulted in a <code>400 Bad Request</code> response: {"error":"invalid_grant","error_description":"AADSTS70000: Transmission data parser failure: Refresh Token is malformed (truncated...)</p>
  </blockquote>
  
  <p>The refresh token is exactly the same as what I got in my initial request.</p>
  
  <p>Anyone experienced with oauth-client/guzzle/Microsoft Graph - What/Where is my error?</p>