POST the current refresh token in the body to receive a NEW access token and a ROTATED refresh token. The presented refresh token is single-use and immediately revoked — the client must persist the returned refreshToken. (Replaces the old GET + `ref-tk` header contract.)

POST/api/auth/refresh-token

Request body

requiredapplication/json

refreshTokenstringrequired

The encrypted refresh token issued at login / last refresh.

Responses

200OK

any

401Unauthorized — refresh token missing/invalid/expired, or already used. Replaying a rotated token revokes ALL of the user’s sessions.

any

500Internal Server Error

any

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Bodyapplication/json

refreshTokenstring*The encrypted refresh token issued at login / last refresh.

Request

curl -X POST "http://localhost:8000/api/auth/refresh-token" \
  -H "Content-Type: application/json" \
  -d '{
  "refreshToken": "iv:authTag:ciphertext"
}'

const response = await fetch("http://localhost:8000/api/auth/refresh-token", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: "{\n  \"refreshToken\": \"iv:authTag:ciphertext\"\n}"
});

Response

{
  "data": {
    "token": "*****",
    "refreshToken": "*****"
  }
}

{
  "message": "Access denied",
  "error": "Unauthorized",
  "statusCode": 401
}

{
  "message": "Something went wrong",
  "error": "Internal Server Error",
  "statusCode": 500
}