# OAuth Flow

:::caution
We highly recommend utilizing our new Member Identity Provider to manage the standard OAuth flow, particularly for new integrations.
For comprehensive technical details, please refer to the [Member Identity Provider docs](https://member-idp.developer.placewise.com/).
:::

In Public API, whenever Member is required to be authenticated, we use OAuth flow based on member **access token**.

In such cases, we use standard `Authorization` HTTP header to pass member **access token** like this:

```
Authorization: Bearer <member_access_token>
```

**Access token** may be retrieved with [Create Token](api-3510810)
endpoint by authenticating member.

It is short-lived. The endpoint also returns **refresh token** which lasts longer and should be stored
until **access token** expires.

When **access token** is no longer valid, server returns `460` status code with a following error:

Status code: 460

```json
{ "error": "Member not authorized" }
```

When this happens, you may use [Refresh token grant](api-3510810#refreshing-token-with-refresh_token-grant)
using a **refresh token** and reload your tokens with those that are returned from it.

When refresh token happens to be no longer valid, server returns `462` status code with following error:

Status code: 462

```json
{ "error": "Invalid refresh token" }
```

In such case, member must be re-authenticated again in order to generate new *refresh* and *access* tokens.