Skip to main content

Refresh a session

POST 
/v1/auth/refresh

Exchanges a valid refresh token for a new access JWT and a rotated refresh token, taken from the body or from the refresh_token cookie set at sign-in — a browser sends an empty body and the cookie carries the credential. Refresh tokens are single-use; presenting a previously-rotated token is treated as reuse and revokes the whole session family (createRefreshRotation reuse detection), except within a few seconds of the rotation, where it is treated as two tabs racing on one cookie and rotated again.

Request​

Responses​

A new session (access + rotated refresh).