POST/api/auth/refresh

Exchanges a valid refresh token for a new access token and refresh token pair. Each refresh token is single-use (rotation) — it becomes invalid after use.

Auth & Security

No authentication required

Idempotent: No

Parameters

refreshToken(body, string, required)— Previously issued refresh token

Example Request

{"refreshToken":"<refresh token from /login>"}

Example Response

{"ok":true,"token":"<new JWT>","refreshToken":"<new refresh token>"}

Error Codes

400 VALIDATION_ERROR — Refresh token is missing, invalid, expired, or already used.

Live Test Proof

Success verified with a real refresh token obtained from /login (new token pair received); negative case with a fabricated token (400).

← Authentication