Index: src/wp-admin/customize.php
===================================================================
--- src/wp-admin/customize.php	(revision 40293)
+++ src/wp-admin/customize.php	(working copy)
@@ -74,6 +74,9 @@
 wp_enqueue_script( 'customize-controls' );
 wp_enqueue_style( 'customize-controls' );
 
+// Setup heartbeat to keep nonces up to date.
+wp_enqueue_script( 'heartbeat' ); 
+
 /**
  * Enqueue Customizer control scripts.
  *
Index: src/wp-admin/js/customize-controls.js
===================================================================
--- src/wp-admin/js/customize-controls.js	(revision 40293)
+++ src/wp-admin/js/customize-controls.js	(working copy)
@@ -3652,6 +3653,18 @@
 				active: $.Deferred()
 			};
 
+			// When the heartbeat returns a refreshed nonce array, apply it.
++           $( document ).on( 'heartbeat-tick.wp-refresh-nonces', function( e, data ) {
++           		if ( 'undefined' !== typeof data['wp-customize-nonces'] ) {
++           				pi.trigger( 'nonce-refresh', data['wp-customize-nonces'] );
++                   }
++           } );
++
++           // Attach our existing nonce to the heartbeat request, so it can be checked for expiration.
++           $( document ).on( 'heartbeat-send.wp-refresh-nonces', function( e, data ) {
++           		data['wp-customize-nonces'] = api.settings.nonce;
++           } );
+
 			// Debounce to prevent hammering server and then wait for any pending update requests.
 			previewer.refresh = _.debounce(
 				( function( originalRefresh ) {
Index: src/wp-includes/class-wp-customize-manager.php
===================================================================
--- src/wp-includes/class-wp-customize-manager.php	(revision 40293)
+++ src/wp-includes/class-wp-customize-manager.php	(working copy)
@@ -366,9 +366,52 @@
 
 		// Export the settings to JS via the _wpCustomizeSettings variable.
 		add_action( 'customize_controls_print_footer_scripts', array( $this, 'customize_pane_settings' ), 1000 );
+
+		// Refresh the customizer nonces using the hearbeat api.
+		add_filter( 'heartbeat_received', array( $this, 'wp_heartbeat_refresh_customizer_nonces' ), 10,  3 );
+		add_filter( 'heartbeat_settings', array( $this, 'wp_heartbeat_settings_customizer_filter' ) );
 	}
+	/**
+	Filter heartbeat settings for the Customizer.
+	*
+	* @since 4.5.0
+	*
+	* @param array $settings  Current settings to filter.
+	* @return array
+	*/
+		    public function wp_heartbeat_settings_customizer_filter( $settings ) {
+					global $pagenow;
+	
++					if ( 'customize.php' !== $pagenow ) {
+							return $settings;
+					}
+					$settings['screenId'] = 'customize';
 
+						return $settings;
+			}
++
 	/**
+	* Return refreshed customizer nonces when needed.
+	*
+	* @since 4.5.0
+	*
+	* @param array  $response  The Heartbeat response.
+	* @param array  $data      The $_POST data sent.
+	* @param string $screen_id The screen id.
+	* @return array The Heartbeat response.
+	*/
+	function wp_heartbeat_refresh_customizer_nonces( $response, $data, $screen_id ) {
+			if ( array_key_exists( 'wp-customize-nonces', $data ) && current_user_can( 'customize' ) ) {
+					$received = $data['wp-customize-nonces'];
+					if ( 2 === wp_verify_nonce( $received['save'], 'save-customize_' . $this->get_stylesheet() ) ) {
+							$response['wp-customize-nonces'] = $this->get_nonces();
+					}
+			}
++
+			return $response;
+	}
++
+	/**
 	 * Return true if it's an Ajax request.
 	 *
 	 * @since 3.4.0
Index: src/wp-includes/js/heartbeat.js
===================================================================
--- src/wp-includes/js/heartbeat.js	(revision 40293)
+++ src/wp-includes/js/heartbeat.js	(working copy)
@@ -367,6 +367,10 @@
 				has_focus: settings.hasFocus
 			};
 
+			if ( 'customize' === settings.screenId  ) {
+					ajaxData.wp_customize = 'on';
+			}
+
 			settings.connecting = true;
 			settings.xhr = $.ajax({
 				url: settings.url,