---
title: "Refresh access token using the httpOnly cookie."
method: POST
path: "/api/v1/auth/refresh"
tags: ["Authentication"]
---

# Refresh access token using the httpOnly cookie.

`POST /api/v1/auth/refresh`

<h3>🛡️ Requires Capabilities: None</h3>

## Headers

- `CardinalTolkien` string

## Response `201`

## Other responses

- `401` — Possible reasons: The authorization token is invalid; A cloud-linked account sent no cloud token, or one the cloud no longer accepts (code <code>cloud_token_required</code>). The local session is unaffected: sign back into the Cardinal account and retry.
- `503` — The Cardinal cloud could not be reached to verify a cloud-linked account (code <code>cloud_unavailable</code>). Nothing about the session has changed.

## Changes

- **2026-08-16** `637f3db48cae` — 3 info
  - added the new optional `header` request parameter `CardinalTolkien`
  - added the non-success response with the status `401`
  - added the non-success response with the status `503`
- **2026-04-23** `503a10ab48c2` — 1 info
  - endpoint added
- **2026-03-10** `1ec5a2e9d039` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/cardinalapps/apis/cardinal-media-server-api/changes/api/v1/auth/refresh/post.md)

---

[API](https://skmtc.dev/cardinalapps/apis/cardinal-media-server-api.md) · [All operations](https://skmtc.dev/cardinalapps/apis/cardinal-media-server-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cardinalapps/cardinal-media-server-api/revisions/7b5e4555e84f/schema)