---
title: "Exchange the refresh token cookie for a new access token"
method: POST
path: "/api/v2/auth/refresh"
tags: ["Login"]
---

# Exchange the refresh token cookie for a new access token

`POST /api/v2/auth/refresh`

## Request

- Base URL: `https://docs.hashtopolis.org`
- URL: `https://docs.hashtopolis.org/api/v2/auth/refresh`
- Auth: API key in cookie `refreshToken`
- TypeScript: <https://skmtc.dev/hashtopolis/apis/hashtopolis-api/docs/api/v2/auth/refresh/post.ts> (a function with typed inputs; its response is checked against the schema)

Reads the refreshToken cookie set by /api/v2/auth/token, rotates it and answers
          with a new access token. Needs no Authorization header, so it keeps working once the previous
          access token has expired. The rotated cookie is returned in Set-Cookie; the token itself is
          never part of the body.

## Response `201`

Success

- Token
  - `token` string, required
  - `expires` integer, required

## Other responses

- `401`: The refresh token is missing, expired, revoked or already used
- `403`: The user has been deactivated

## Changes

- **2026-10-03** `2779711dea1d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hashtopolis/apis/hashtopolis-api/changes/api/v2/auth/refresh/post.md)

---

[API](https://skmtc.dev/hashtopolis/apis/hashtopolis-api.md) - [All operations](https://skmtc.dev/hashtopolis/apis/hashtopolis-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hashtopolis/apis/hashtopolis-api/revisions/87f3bd43387f?raw)