---
title: "Exchange a refresh token for a new token pair"
method: POST
path: "/auth/refresh"
tags: ["Auth"]
---

# Exchange a refresh token for a new token pair

`POST /auth/refresh`

## Request

- Base URL: `https://api.medianfi.com/api/v1`
- URL: `https://api.medianfi.com/api/v1/auth/refresh`
- Auth: none required

## Request body

- RefreshInput
  - `refreshToken` string: Optional when the refresh token is available in the HttpOnly cookie.
  - `companyId` string, uuid: Preferred active company context for users with multiple memberships.

## Response `200`

New token pair issued

- TokenPairResponse
  - `success` boolean
  - `data` object
    - `accessToken` string: Short-lived JWT access token
    - `refreshToken` string: Opaque refresh token (rotate on each use)
    - `expiresIn` integer: Access token TTL in seconds
    - `user` User
      - `id` string, uuid
      - `email` string, email
      - `name` string
      - `phone` string, nullable
      - `jobTitle` string, nullable
      - `createdAt` string, date-time
      - `updatedAt` string, date-time
    - `companyId` string, nullable
    - `canSeeInternalUi` boolean: True when the primary company is allowlisted for customer-app preview UI
    - `memberships` UserContextMembership[]
      - `companyId` string, uuid
      - `companyName` string, nullable
      - `role` 'owner' | 'admin' | 'cfo' | 'member' | 'viewer'

## Other responses

- `401`: Refresh token invalid, expired, or revoked
- `422`: Validation error

---

[API](https://skmtc.dev/medianfi/apis/median-api.md) · [All operations](https://skmtc.dev/medianfi/apis/median-api/llms.txt) · [OpenAPI document](https://skmtc.dev/medianfi/apis/median-api/revisions/20090ea32b0d?raw)