---
title: "Refresh Token"
method: POST
path: "/api/v1/auth/refresh"
tags: ["Authentication"]
---

# Refresh Token

`POST /api/v1/auth/refresh`

## Request

- Base URL: `https://app.aimrank.io` (the document declares no server; this is the origin it was published from)
- URL: `https://app.aimrank.io/api/v1/auth/refresh`
- Auth: none declared

Refresh access token using refresh token.

Resolves the refresh token in priority order:
1. HttpOnly `aimrank_refresh` cookie (browser sessions — the normal case)
2. Request body `refresh_token` (programmatic clients sending JSON)
3. Query string `refresh_token` (legacy)

Returns 401 if none of these produce a valid token — callers should
treat that as "session is gone, redirect to /login".

## Request body

- RefreshBody
  - `refresh_token` string, nullable

## Response `200`

Successful Response

- Token
  - `access_token` string, required
  - `refresh_token` string, required
  - `token_type` string
  - `requires_2fa` boolean

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/aimrank/apis/aimrank-api.md) · [All operations](https://skmtc.dev/aimrank/apis/aimrank-api/llms.txt) · [OpenAPI document](https://skmtc.dev/aimrank/apis/aimrank-api/revisions/3574d0aff459?raw)