> ## Documentation Index
> Fetch the complete documentation index at: https://docs.drssed.app/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /auth/refresh — Exchange tokens for a new pair

> Exchange a refresh token for a new access token and refresh token pair. Rate limited to 5 requests per minute. Both tokens are rotated.

Call `POST /auth/refresh` to exchange your current refresh token for a new access token and a new refresh token. Both tokens are rotated on every call — the old refresh token is invalidated immediately after use. You can call this endpoint even if the current access token has already expired, as long as the refresh token is still valid.

## Endpoint

| Field         | Value           |
| ------------- | --------------- |
| Method        | `POST`          |
| Path          | `/auth/refresh` |
| Auth required | No              |
| Rate limit    | 5 per minute    |

## Request body

<ParamField body="access_token" type="string" required>
  Your current access token. This may be expired.
</ParamField>

<ParamField body="refresh_token" type="string" required>
  Your current refresh token. Must be valid and unused.
</ParamField>

## Response fields

**Status: 200 OK**

<ResponseField name="access_token" type="string" required>
  New JWT access token. Replace your stored access token with this value.
</ResponseField>

<ResponseField name="expires_in" type="integer" required>
  Number of seconds until the new access token expires.
</ResponseField>

<ResponseField name="refresh_token" type="string" required>
  New refresh token. Replace your stored refresh token with this value immediately.
</ResponseField>

## Example

```bash cURL theme={null}
curl --request POST \
  --url https://api.drssed.com/auth/refresh \
  --header 'Content-Type: application/json' \
  --data '{
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "refresh_token": "drt_a1b2c3d4e5f6..."
  }'
```

```json Response theme={null}
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 3600,
  "refresh_token": "drt_g7h8i9j0k1l2..."
}
```

<Note>
  Store the new `refresh_token` from every response. The previous refresh token is invalidated immediately after use and cannot be reused.
</Note>