---
title: "Refresh Extension Credential"
method: POST
path: "/browser-extension/credentials/refresh/"
tags: ["browser-extension"]
---

# Refresh Extension Credential

`POST /browser-extension/credentials/refresh/`

Rotate the presented credential before it expires.

Installation-credential auth only: the extension no longer holds a
session to re-mint with, so rotation is how an installation outlives the
credential TTL. The old credential stays valid for a short grace window
so requests in flight during the swap cannot fail into a sign-out. The
flag gate runs here too — turning a user's flag off ends their ability
to keep a credential alive.

## Response `200`

Successful Response

- ExtensionCredentialResponse — A freshly issued installation credential. The raw credential appears only here — the server keeps a hash. The expiry is advisory scheduling data for the client's refresh; the server-side TTL remains the authority.
  - `credential` string, required
  - `expires_at` string, date-time, required
  - `scopes` string[], required

---

[API](https://skmtc.dev/helloaxel/apis/client-api-gateway.md) · [All operations](https://skmtc.dev/helloaxel/apis/client-api-gateway/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/helloaxel/client-api-gateway/revisions/d3c4c29fede7/schema)