---
title: "Rotate the access token using the refresh-token cookie"
method: POST
path: "/auth/refresh"
tags: ["Auth"]
---

# Rotate the access token using the refresh-token cookie

`POST /auth/refresh`

## Request

- Base URL: `http://localhost:38200`
- URL: `http://localhost:38200/auth/refresh`
- Auth: none required

Reads the `refresh_token` httpOnly cookie, rotates it, and issues a new short-lived JWT access-token cookie. A replayed (already-consumed) refresh token revokes the entire token family (theft detection).

## Response `200`

New JWT + refresh cookies set.

- object
  - `message` string

## Other responses

- `401`: Missing, invalid, expired, or already-used refresh token.

---

[API](https://skmtc.dev/contextq/apis/contextq-api.md) · [All operations](https://skmtc.dev/contextq/apis/contextq-api/llms.txt) · [OpenAPI document](https://skmtc.dev/contextq/apis/contextq-api/revisions/7afc44056a22?raw)