Auth

Refresh

Exchange a valid refresh token for a new access + refresh token pair.

Multi-tenant clients must call this endpoint on their tenant host. Refresh tokens are opaque and carry no bearer tid claim, so tenant middleware binds the database transaction from that same-origin host before the user row is resolved and the next tenant-bound access token is minted.

GH-1302: with X-GeoLens-Auth-Mode: cookie the presented token is read from the httpOnly cookie (falling back to the body once, so a session established before the cookie flow shipped migrates on its next refresh instead of being logged out), the double-submit CSRF token is enforced, and the rotated token goes back out as a cookie with a null body refresh_token. Without the header this endpoint behaves exactly as before.

post/auth/refresh/

Request

  • The document declares no server URL.
  • Auth: none declared

Headers

X-GeoLens-Auth-Modestring nullable

Browser session-transport negotiation. Send cookie to carry the refresh token in an httpOnly geolens_refresh cookie, paired with a script-readable geolens_csrf cookie, and receive a null refresh_token in the response body. When the header is absent (the default) the refresh token is returned in the response body, which is the contract every non-browser caller uses.

X-CSRF-Tokenstring nullable

Double-submit CSRF token, enforced only when the refresh cookie is what authenticates the call. Echo the value of the geolens_csrf cookie issued alongside the refresh cookie. Callers presenting a refresh token in the request body do not send it.

Request body

refresh_tokenstring required

Response

Successful Response

access_tokenstring required

JWT access token for Authorization header

refresh_tokenstring nullable required

Opaque token used to obtain a new access token. Always present for programmatic callers (CLI, SDKs, CI). Null when the caller opted into the browser cookie flow with 'X-GeoLens-Auth-Mode: cookie', in which case the token is delivered as an httpOnly cookie instead (GH-1302).

token_typestring
expires_ininteger required

Seconds until the access token expires

Changes

No recorded changes to this operation across all 50 revisions of this API.