How to Update Hotmail and Outlook Refresh Tokens: Graph, IMAP and POP3 OAuth2 Guide

Refresh Token is an important part of Hotmail and Outlook OAuth2 email receiving. If you use Microsoft Graph, IMAP OAuth2 or POP3 OAuth2 to read emails, the Refresh Token is used to keep authorization active and request new temporary Access Tokens when needed.

Refresh Tokens for Hotmail/Outlook accounts are usually valid for 90 days from creation, so they should be updated before expiration.

For users who buy Hotmail accounts in bulk, purchase Outlook accounts wholesale, read verification emails, or manage multiple email accounts through automation, keeping Refresh Tokens updated can reduce login interruptions and improve long-term receiving stability.

In This Article

1. What is a Refresh Token?

2. How Graph, IMAP and POP3 use tokens

3. When should you update a Refresh Token?

4. How to update a Refresh Token

5. Python example for updating one account

6. Python example for updating accounts in bulk

7. Third-party receiving software and automatic token updates

8. Important notes before updating tokens

1. What Is a Refresh Token?

A Refresh Token is a long-term authorization credential used in OAuth2.0.

In simple terms, the password proves account login information, while the Refresh Token is used to maintain authorized access for email receiving. When a program needs to read emails through Graph, IMAP or POP3 OAuth2, it first uses the Refresh Token and Client ID to request an Access Token.

The Access Token is temporary and usually expires quickly. The Refresh Token lasts longer and can be used to request new Access Tokens repeatedly before it expires or becomes invalid.

Hotmail007 accounts that support token-based receiving are usually delivered in this format:

email:password:refreshToken:clientId

2. How Graph, IMAP and POP3 Use Tokens

Graph, IMAP and POP3 are different ways to read Hotmail/Outlook emails.

Graph is Microsoft’s modern API for reading Outlook mailbox data. It is commonly used for verification email reading, automated email receiving, account management systems and API integration.

IMAP and POP3 are traditional email receiving protocols. When OAuth2.0 is used with IMAP or POP3, the program also needs an Access Token to authenticate the connection.

The key point is simple:

• Refresh Token is used to maintain authorization

• Access Token is used for the actual email access request

• Graph, IMAP and POP3 use different Access Tokens

• Whether an account can use Graph, IMAP or POP3 depends on the account type and enabled features

If a Hotmail/Outlook account only supports Graph, it cannot be used for IMAP login. If an account supports both IMAP and Graph, the latest valid Refresh Token can be used to request the required Access Token for the supported receiving method.

3. When Should You Update a Refresh Token?

A Hotmail/Outlook Refresh Token is usually valid for about 90 days from creation. To avoid interruption, it is recommended to update the Refresh Token before it expires.

You should update the Refresh Token when:

• The token is close to expiration

• You need long-term automated email receiving

• You manage many Hotmail or Outlook accounts

• Your script or system depends on Graph, IMAP or POP3 OAuth2

• You want to keep verification email receiving stable

If the Refresh Token is already expired or revoked, refreshing may fail. In that case, you need a new valid token or new authorized account information.

4. How to Update a Refresh Token

When requesting an Access Token, include offline_access in the scope. If the request succeeds and the response contains a new refresh_token, save the new Refresh Token immediately.

For Graph receiving, the common scope can be:

https://graph.microsoft.com/.default offline_access

For IMAP OAuth2 receiving, use:

https://outlook.office.com/IMAP.AccessAsUser.All offline_access

For POP3 OAuth2 receiving, use:

https://outlook.office.com/POP.AccessAsUser.All offline_access

The scope tells the token endpoint what type of Access Token you want to request. It does not mean that you need to maintain multiple Refresh Tokens manually.

After updating, always save the newest full account line. That line replaces the old Refresh Token with the newly returned Refresh Token. For future receiving, token updates or third-party tool import, use the latest account line.

5. Python Example: Update One Refresh Token

This example updates the Refresh Token for one Hotmail/Outlook account and prints the new full account line.

import requests

TOKEN_ENDPOINT = "https://login.microsoftonline.com/consumers/oauth2/v2.0/token"
DEFAULT_SCOPE = "https://graph.microsoft.com/.default offline_access"


def parse_account(account_line):
    parts = account_line.strip().split(":")
    if len(parts) < 4:
        raise ValueError("Expected format: email:password:refreshToken:clientId")

    email = parts[0]
    password = parts[1]
    client_id = parts[-1]
    refresh_token = ":".join(parts[2:-1])

    return email, password, refresh_token, client_id


def update_refresh_token(refresh_token, client_id, scope=DEFAULT_SCOPE):
    response = requests.post(
        TOKEN_ENDPOINT,
        data={
            "client_id": client_id,
            "grant_type": "refresh_token",
            "refresh_token": refresh_token,
            "scope": scope,
        },
        timeout=30,
    )

    result = response.json()

    if response.status_code != 200:
        raise RuntimeError(result)

    new_refresh_token = result.get("refresh_token")
    if not new_refresh_token:
        raise RuntimeError("No new refresh_token returned. Please check scope and account status.")

    return new_refresh_token, result.get("expires_in")


def main():
    account = "email:password:refreshToken:clientId"

    email, password, old_refresh_token, client_id = parse_account(account)
    new_refresh_token, expires_in = update_refresh_token(old_refresh_token, client_id)

    updated_account = f"{email}:{password}:{new_refresh_token}:{client_id}"

    print("New account line:")
    print(updated_account)
    print("Access token expires in:")
    print(expires_in)


if __name__ == "__main__":
    main()

After running the code, save the full line printed under New account line. This line already contains the new Refresh Token.

6. Python Example: Update Refresh Tokens in Bulk

If you manage many Hotmail/Outlook accounts, you can place them in one file and update them in bulk.

Create a file named:

email_accounts_to_update.txt

Put one account per line:

email1:password:refreshToken:clientId
email2:password:refreshToken:clientId
email3:password:refreshToken:clientId

Then use this Python script:

from concurrent.futures import ThreadPoolExecutor, as_completed
from pathlib import Path
import time

import requests

TOKEN_ENDPOINT = "https://login.microsoftonline.com/consumers/oauth2/v2.0/token"
DEFAULT_SCOPE = "https://graph.microsoft.com/.default offline_access"

INPUT_FILE = Path("email_accounts_to_update.txt")
MAX_WORKERS = 10
RETRY_TIMES = 3


def parse_account(account_line):
    parts = account_line.strip().split(":")
    if len(parts) < 4:
        raise ValueError("Expected format: email:password:refreshToken:clientId")

    email = parts[0]
    password = parts[1]
    client_id = parts[-1]
    refresh_token = ":".join(parts[2:-1])

    return email, password, refresh_token, client_id


def request_new_refresh_token(refresh_token, client_id, scope=DEFAULT_SCOPE):
    last_error = None

    for attempt in range(1, RETRY_TIMES + 1):
        try:
            response = requests.post(
                TOKEN_ENDPOINT,
                data={
                    "client_id": client_id,
                    "grant_type": "refresh_token",
                    "refresh_token": refresh_token,
                    "scope": scope,
                },
                timeout=30,
            )

            result = response.json()

            if response.status_code == 200 and result.get("refresh_token"):
                return result["refresh_token"]

            last_error = result

        except Exception as error:
            last_error = str(error)

        if attempt < RETRY_TIMES:
            time.sleep(attempt * 2)

    raise RuntimeError(last_error)


def update_account(account_line):
    email, password, old_refresh_token, client_id = parse_account(account_line)
    new_refresh_token = request_new_refresh_token(old_refresh_token, client_id)
    return f"{email}:{password}:{new_refresh_token}:{client_id}"


def main():
    account_lines = [
        line.strip()
        for line in INPUT_FILE.read_text(encoding="utf-8").splitlines()
        if line.strip()
    ]

    updated_accounts = []
    failed_accounts = []

    with ThreadPoolExecutor(max_workers=MAX_WORKERS) as executor:
        tasks = {
            executor.submit(update_account, account): account
            for account in account_lines
        }

        for task in as_completed(tasks):
            original_account = tasks[task]
            try:
                updated_accounts.append(task.result())
            except Exception as error:
                failed_accounts.append(f"{original_account} | {error}")

    updated_file = Path(f"email_accounts_updated_{len(updated_accounts)}.txt")
    failed_file = Path(f"email_accounts_failed_{len(failed_accounts)}.txt")

    updated_file.write_text("\n".join(updated_accounts), encoding="utf-8")
    failed_file.write_text("\n".join(failed_accounts), encoding="utf-8")

    print(f"Total: {len(account_lines)}")
    print(f"Updated: {len(updated_accounts)}")
    print(f"Failed: {len(failed_accounts)}")
    print(f"Updated file: {updated_file}")
    print(f"Failed file: {failed_file}")


if __name__ == "__main__":
    main()

The output file name includes the number of successfully updated accounts. For example:

email_accounts_updated_98.txt
email_accounts_failed_2.txt

Use the updated file for future email receiving, token maintenance or system import.

7. Third-Party Receiving Software and Automatic Token Updates

Some third-party receiving tools automatically refresh tokens after you import the account. In this case, the software may request a new Access Token each time it reads emails, and it may also save the newly returned Refresh Token in the background.

This is why some users do not see the token changing manually. The tool may already be handling token maintenance internally.

Hotmail007 also plans to release a free email receiving software. After importing accounts, the software will handle email receiving and token updates in the background. When a new Refresh Token is returned, it will be saved in the receiving software backend, so users do not need to manually update tokens every time.

8. Important Notes Before Updating Tokens

Before refreshing Hotmail/Outlook tokens, check the following points:

• The account format should be complete

• The Refresh Token and Client ID should match the same account

• The account type must support the receiving method you want to use

• Graph-only accounts cannot be used for IMAP login

• Use the latest updated account line after every successful refresh

• Do not expose Refresh Tokens publicly

• If refreshing fails, check account status, token validity, request scope and network environment

For bulk Hotmail accounts, wholesale Outlook accounts, verification code receiving and automated mailbox management, token maintenance should be done before expiration instead of after receiving errors.

Conclusion

Updating Hotmail and Outlook Refresh Tokens is important for long-term Graph, IMAP and POP3 OAuth2 email receiving. The core rule is simple: use the Refresh Token and Client ID to request a new Access Token, include offline_access when refreshing, and save the newly returned Refresh Token.

For users who need bulk Hotmail accounts, wholesale Outlook accounts, Graph receiving, IMAP OAuth2 receiving or automated verification email reading, keeping Refresh Tokens updated can make account management smoother and more reliable.