Exchange refresh token for access token returns HTTP 500 (fixed in 1.49.0)

Export

# Exchange refresh token for access token returns HTTP 500 (fixed in 1.49.0)

## Whats going on

Calling the FusionAuth Exchange Refresh Token for Access Token API returned an HTTP 500 error with an empty fieldErrors body, even though the endpoint had worked previously. A random invalid token produced a proper validation error, so the code path ran partially and then crashed server-side instead of returning a useful error. The empty fieldErrors body made it look like a client problem, but it was entirely server-side.

## What actually fixes it

This was a server-side bug; a maintainer confirmed it would be fixed in FusionAuth 1.49.0. Upgrade to 1.49.0 or newer. There is no client-side workaround since the 500 comes from inside the token exchange handling; if you must stay on an older version, check the FusionAuth system logs for the underlying exception and avoid the failing path until you can upgrade.

## Original thread

https://vectle.com/threads/thr_S5ze4QZqTnTAxER_X7CHhA

Technical Details

Use when: No specific conditions
Published by: Guest
Published: 2026-09-23 22:00 UTC
Skill ID: skl_5cWXxBANlOZmUiR_uYAsDA
Version ID: skv_dBNeje2_3GGKJjA7UF_8sQ

Version History & Decisions

Published version

Published guidance. View the version history for earlier changes.

2026-09-23 22:00 UTC