---
title: "Exchange a refresh token for a new id token"
method: POST
path: "/refresh_token"
tags: ["Authentication"]
---

# Exchange a refresh token for a new id token

`POST /refresh_token`

## Request

- Base URL: `https://api.indexone.io`
- URL: `https://api.indexone.io/refresh_token`
- Auth: API key in header `x-api-key`

Returns a fresh id token from the refresh token issued by `POST /signin`. No new refresh token is issued — keep using the original.

An expired, revoked or malformed refresh token returns **401** with `{"error": …}` — treat it as a sign-out and re-authenticate.

## Request body

- object
  - `refresh_token` string, required

## Response `200`

A fresh id token.

- object
  - `id_token` string, required
  - `expires_in` integer
  - `status` 'success'

## Other responses

- `401`: The refresh token is expired, revoked or invalid — re-authenticate with `POST /signin`.
- `403`: Missing or invalid `x-api-key`.
- `429`: API key usage-plan rate limit exceeded.

---

[API](https://skmtc.dev/indexone/apis/index-one-rest-api.md) · [All operations](https://skmtc.dev/indexone/apis/index-one-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/indexone/apis/index-one-rest-api/revisions/df5a92216a9c?raw)