Refresh an active Embedded Wallet auth session and create a new session signing key. Session refresh is a two-step signed-retry flow:

1. Call POST /auth/sessions/{id}/refresh with the request body { "clientPublicKey": "02..." } and no signature headers. Send a freshly generated P-256 public key as a compressed key in lowercase hex (66 characters, 02 or 03 prefix) and retain its private key. Grid binds the supplied clientPublicKey into the session-refresh payload, persists it as a pending request, and returns 202 with payloadToSign, requestId, and expiresAt.

2. Sign payloadToSign with the current session signing key, then retry the same request with the full API-key stamp as Grid-Wallet-Signature, the requestId echoed back as Request-Id, and the same clientPublicKey in the request body. On success, Grid returns a new AuthSession. The client keeps the private key matching clientPublicKey as the new session signing key, and no key material is returned. An uppercase or uncompressed key is rejected with 400 INVALID_INPUT.

The original session must still be active on both steps so it can authorize the refresh. If the session has already expired, use the credential reauthentication flow instead.

{
  "clientPublicKey": "02f45f2a22c908b9ce09a7150e514afd24627c401c38a4afc164e1ea783adaaa31"
}

{
  "status": "PROCESSING",
  "message": "This login is still being processed. Retry the same request in a moment."
}