Skip to main content
POST
Refresh Token
Uses a valid refresh token to obtain a new access token and refresh token pair. The previous refresh token is invalidated (token rotation) to prevent replay attacks.

Auth

None required. The refresh token in the request body serves as authentication.

Rate Limit

20 requests per minute per IP.

Request Body

string
required
The refresh token received from a previous login or refresh response.

Response

string
New JWT access token. Expires in 15 minutes.
string
New JWT refresh token. Expires in 7 days. Store this for the next rotation.
number
Access token expiry in seconds (900).

Errors

Example