Genesys Cloud API token expiring too fast for CI/CD pipeline

Trying to set up a GitHub Actions workflow to push config changes via the Genesys Cloud SDK. The standard OAuth client_credentials flow gives me a token that expires in an hour. My pipeline runs fine if it’s quick, but if it gets stuck in the queue or hits a rate limit retry, the token dies and the job fails with 401 Unauthorized.

I’ve checked the developer docs and the UI settings for the integration. There’s no obvious checkbox for “extend token lifetime” or “long-lived access token”. The refresh_token grant type seems to require a user context which I can’t use for a service account in an automated pipeline.

Is there a specific API endpoint or header I’m missing to get a token that lasts longer than 3600 seconds? Or is the only workaround to call the token endpoint at the start of every single step in the workflow?

Here’s the curl I’m using to test locally:

curl -X POST "https://api.mypurecloud.com/oauth/token" \
 -H "Content-Type: application/x-www-form-urlencoded" \
 -d "grant_type=client_credentials&client_id=MY_CLIENT_ID&client_secret=MY_SECRET"

Response always has "expires_in": 3600. Feels like a dead end.

The docs say the access token is 3600 seconds. You can’t change that. But you can use the refresh token. The .NET SDK handles this automatically if you set it up right.

Here is how we do it in Azure Functions. We cache the token and let the SDK refresh it when needed.

var settings = new PlatformClientSettings
{
 ClientId = "your_client_id",
 ClientSecret = "your_client_secret",
 RefreshToken = "your_refresh_token", // Get this from initial auth
 Environment = "mypurecloud.com"
};
var client = new PlatformClient(settings);

Make sure you have the oauth:standard:offline scope. Without that, you don’t get a refresh token. The SDK will throw a 401 if it tries to use an expired token without a refresh mechanism in place.

Just store the refresh token securely. It doesn’t expire as quickly. We use Azure Key Vault for this. The pipeline fetches the token, does the work, and the SDK handles the refresh in the background. It’s not smooth, but it works.