---
title: "Rotate a refresh token for a new pair"
method: POST
path: "/auth/tokens/refresh"
tags: ["Auth"]
---

# Rotate a refresh token for a new pair

`POST /auth/tokens/refresh`

## Request

- Base URL: `https://bodylab.lol/api/v1`
- URL: `https://bodylab.lol/api/v1/auth/tokens/refresh`
- Auth: none required

## Headers

- `X-Client-Platform` string
- `X-Client-Version` string

## Request body

- object
  - `refreshToken` string, required

## Response `200`

OK

- object
  - `accessToken` string, required: Short-lived; send as `Authorization: Bearer <token>`.
  - `refreshToken` string, required: Rotates on every refresh; reusing an old one revokes the chain.
  - `expiresIn` integer, required: Seconds until the access token expires.
  - `userId` string, required: Opaque identifier.

## Other responses

- `401`: Error: INVALID_REFRESH_TOKEN.

---

[API](https://skmtc.dev/bodylab/apis/body-lab-api.md) · [All operations](https://skmtc.dev/bodylab/apis/body-lab-api/llms.txt) · [OpenAPI document](https://skmtc.dev/bodylab/apis/body-lab-api/revisions/544c201eaf88?raw)