Exchange a refresh token

POST /api/v1/auth/refresh

Issues a new session token from a refresh token. Only available when the original login asked for one.

An expired refresh token and an unknown one answer identically, on purpose. A revoked session is the one case that is distinguished, because the remedy differs: sign in again rather than retry.

At a glance

Authentication: Public
Rate limit: refresh

Parameters

Parameter	Description
`refresh_token`required body · string	The refresh token returned by login. Shown once; only its hash is stored.

Errors

Code	When it is returned
`ERR_UNAUTHORIZED`401	the session was signed out (session_revoked), or the token is unknown or expired (invalid_credentials)

Request

curl -X POST "$BASE/api/v1/auth/refresh" \
  -H "Authorization: Bearer $XR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "refresh_token": "wA7k2Jd9..."
}'

BASE is your tenant host: the same address you sign in on.

Try it on your own network.

50 subscribers for 7 days. You pay nothing.

Try it free Talk to us