Refresh Access Token

Exchanges a valid refresh token for a new access token and refresh token pair, extending the user's session without requiring them to re-enter their password.

Token rotation (security)
This endpoint implements single-use refresh tokens. When you call this endpoint:

Your refresh_token is validated.

A brand new access_token and refresh_token are generated.

The old refresh_token is immediately invalidated and cannot be reused.

This means if an attacker steals a refresh token and uses it, the legitimate user's next refresh attempt will fail, alerting them to the potential compromise.

When to call this endpoint

Your client receives a 401 Unauthorized from any API endpoint (access token has expired).

Proactively when you detect the access token is near expiry (check expires_in from the login response).

If the refresh token is also expired
The user must re-authenticate via POST /oauth/token.

{ "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9sdsaECAdsz123", "refresh_token": "xyz789refresh012345678901234567890", "token_type": "Bearer", "expire": "2026-04-06T12:34:56.789Z", "refresh_expire": "2026-10-06T12:34:56.789Z" }

Refresh Access Token

Request

Responses