Sign in
authentication

Refresh Token

Changed on

Refresh access token using refresh token.

Returns a new access token only. The refresh token is NOT rotated - client should continue using the same refresh token until it expires. This ensures users must re-login periodically, improving security for self-hosted deployments.

Accepts the refresh token either in the request body (the /legacy/ Flutter client) or via the journiv_refresh HttpOnly cookie (the React PWA). The cookie is refreshed on success so its Max-Age slides; the JWT's own exp claim is unchanged and still governs the 7-day window.

The client should:

  1. Keep using the same refresh token
  2. Use the new access token for API requests
  3. Re-login when the refresh token expires
post/api/v1/auth/refresh

Request

  • The document declares no server URL.
  • Auth: none declared

Request body

refresh_tokenstring nullable

Response

Successful Response

access_tokenstring required
refresh_tokenstring nullable
token_typestring

Changes

  • 9e06708f5c9eRevision changes
    • breaking

      the request's body type changed from object to no type

    • warning

      removed the request property

    • info

      added subschema #2 to the request body anyOf list

    • info

      request body became optional