Outcome
Keep each customer's connection working as access tokens expire. Reconnect your customer when needed.
Remembered customer approval
mylab remembers an active approval for the same customer, registered third-party app and exact results scope. When your customer connects again under those same conditions, mylab still authenticates them but skips the consent screen while the approval remains active.
If you request a different scope, a grant is revoked or no active grant exists, send your customer through authorisation again. Your customer must approve any new request.
Refresh an access token
Your access token is configured to expire after 1 hour and your refresh token after 365 days. Use the token response's expires_in value, in seconds, to track the access token's expiry for your registered application. Refresh the access token before it expires. Refresh tokens rotate: store each replacement returned by a successful refresh securely and serialise refresh attempts for each customer connection.
POST {token_endpoint}
Content-Type: application/x-www-form-urlencoded
grant_type=refresh_token
&client_id={client_id}
&refresh_token={current_refresh_token}If mylab persistently rejects the refresh token, reconnect your customer through the mylab connection flow. mylab authenticates your customer and skips the consent screen if the same active approval still exists for that customer, app and exact scope. If no matching active approval exists, mylab asks your customer to review and approve a new request.
Disconnecting is different from revoking access
If you clear your app's local connection data, you remove the credentials your app holds locally. This does not revoke the mylab grant. Explain this difference to customers when they disconnect.
The public Client API does not provide an endpoint for your third-party app to revoke a customer's Connected Apps grant, and customers cannot currently revoke grants through a self-service page in mylab. If an employee who authorised your app leaves your customer's organisation, notify the Hill Labs support team or your onboarding contact. Hill Labs will revoke that employee's grant.
Reconnect after access is revoked
After Hill Labs revokes a grant, that connection can no longer retrieve results. Ask your customer to connect again and approve your third-party app. Re-enabling the app registration does not restore an individually revoked grant.
Common access errors
| Status | Meaning | Next step |
|---|---|---|
| 401 Unauthorised | The bearer token is invalid or expired. | Refresh it. If refresh is persistently rejected, restart the connection flow. |
| 403 Forbidden | The results scope, active customer grant or enabled third-party app registration is missing. | Check the connection and third-party app registration. Contact the Hill Labs support team if the issue continues. |
| 404 Not found | The result or job is unknown or the customer who approved your app cannot access it through mylab. | Check the identifier and the customer's access in mylab. |
| 503 Service unavailable | A required permission or results service could not complete the request. | Retry later with backoff and discard incomplete pages. |
Return to Connected Apps start here to review the setup checklist.