Skip to main content
Call POST /auth/refresh to exchange your current refresh token for a new access token and a new refresh token. Both tokens are rotated on every call — the old refresh token is invalidated immediately after use. You can call this endpoint even if the current access token has already expired, as long as the refresh token is still valid.

​
Endpoint

​
Request body

​
access_token
string
required
Your current access token. This may be expired.
​
refresh_token
string
required
Your current refresh token. Must be valid and unused.

​
Response fields

Status: 200 OK
​
access_token
string
required
New JWT access token. Replace your stored access token with this value.
​
expires_in
integer
required
Number of seconds until the new access token expires.
​
refresh_token
string
required
New refresh token. Replace your stored refresh token with this value immediately.

​
Example

cURL
Response
Store the new refresh_token from every response. The previous refresh token is invalidated immediately after use and cannot be reused.