diff --git a/oauth2/index.php b/oauth2/index.php
index ba5c62b..4a3d094 100644
--- a/oauth2/index.php
+++ b/oauth2/index.php
@@ -60,7 +60,10 @@ function showPage($page_title, $h1_text, $h1_color, $body_text) {
 // ===================================================================
 // Citire explicita parametri GET (FR-10: elimina parse_str care injecta variabile)
 // ===================================================================
-$refresh_token     = isset($_GET['refresh_token'])      ? (string)$_GET['refresh_token']      : '';
+// refresh_token vine din ROA prin POST body (refreshToken - anaf_efactura.prg) sau GET;
+// originalul folosea $_REQUEST, deci accepta ambele - citirea doar din $_GET rupe butonul Actualizare
+$refresh_token     = isset($_POST['refresh_token'])     ? (string)$_POST['refresh_token']
+                   : (isset($_GET['refresh_token'])     ? (string)$_GET['refresh_token']      : '');
 $code              = isset($_GET['code'])               ? (string)$_GET['code']               : '';
 $state_param       = isset($_GET['state'])              ? (string)$_GET['state']              : '';
 $error_param       = isset($_GET['error'])              ? (string)$_GET['error']              : '';