Skip to main content
POST
Refresh access token
Use this when an access_token has expired and the refresh_token is still valid. The SDK does this automatically after a 401.

Body

string
required
The refresh token returned by /auth/token-exchange.

Response — 200

string
Fresh 24h JWT.
string
May be rotated. Store the value returned by the response.
string
Always "bearer".
number
Lifetime of the new access token in seconds.

Example

When refresh fails

If the refresh token is expired (more than 7 days old) or revoked, /auth/refresh returns 401. At that point, call /auth/token-exchange with the original API key. If the API key is also gone, ask the user or service to authenticate again.

After 401

Without the SDK, implement this sequence in your HTTP client. With the SDK, AuthenticationError usually means refresh and exchange both failed.