Users

Refresh session token

Changed on

Re-mint the caller's login JWT before it expires (sliding session).

Only user login JWTs are refreshable; permissions and the must_change_password gate are re-read from the database at re-mint. Refusal modes: 401 session_expired once the original authentication is older than the absolute window (admin.auth.session_ttl_seconds), 401 invalid_credentials for deactivated users, non-user tokens, or opaque (non-JWT) credentials. Clients should then send the user back to login.

post/auth/refresh

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /auth/refresh
  • Auth: one of:
    • HTTP bearer
    • OAuth 2 (authorization code, authorization URL /authorize, token URL /oauth/token)

Response

Successful Response

access_tokenstring required

Signed JWT to send as a bearer token on subsequent requests.

expires_ininteger required

Lifetime of the access token in seconds.

must_change_passwordboolean required

Whether the user must change their password before using other endpoints.

token_typestring required

Token type; always bearer.

Example response

{
  "access_token": "example-access-token",
  "expires_in": 3600,
  "must_change_password": false,
  "token_type": "bearer"
}

Changes