---
title: "Refresh Token"
method: POST
path: "/api/auth/refresh"
tags: ["Authentication Service"]
---

# Refresh Token

`POST /api/auth/refresh`

Use the **refresh_token** to continue a user session without requiring the user to re-enter authentication details.

This endpoint is typically used by web or mobile applications after login to keep the user signed in.

**Header example**:
```
Authorization: Bearer {refresh_token}
```

**Refresh behavior:**
- A new access token is generated.
- Both a new access token and a new refresh token are returned.
- The previous **refresh_token** expires.

⚠️ **Important:** Never expose the `refresh_token` outside of the application. It must be stored securely and treated as highly sensitive.

## Response `200`

Token refreshed successfully

- OAuth2TokenResponse — Represents the response returned after a successful authentication.
  - `access_token` string — JWT access token used to authenticate API requests.
  - `token_type` string — The type of token issued, typically 'Bearer'.
  - `expires_in` integer — The number of seconds until the access token expires.
  - `refresh_token` string — Refresh token used to obtain a new access token. Previous refresh_token expires once a new one is issued.

## Other responses

- `401` — Invalid or expired refresh token
- `500` — Internal server error

---

[API](https://skmtc.dev/civikestpayment/apis/tpe-authentication-api.md) · [All operations](https://skmtc.dev/civikestpayment/apis/tpe-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/civikestpayment/tpe-authentication-api/revisions/cc52506f2753/schema)