Skip to main content

Trade a refresh token for the next session.

POST 
/api/auth/refresh

The presented token is revoked in the same call, so a refresh token is good exactly once. A client that retries a failed refresh with the same value gets a 401, which is the correct answer: the one it should retry with is in the response it did not read.

Request​

Responses​

the next session token and the next refresh token