Authentication

Refresh Token

Rotate a refresh token into a new token pair.

The new pair reproduces the old identity exactly (org, user, session, act marker, originating key) — never more. Tokens exchanged from an API key carry its id (key_id); that key must still exist, be active and belong to the token's org, otherwise the chain is dead (revocation used to be ineffective here because every refresh minted a fresh 7-day token). Roles are the token's roles narrowed to the key's CURRENT scopes, so a refresh can drop privileges but never add them.

Refresh tokens without key_id (minted before key binding, or by the DEBUG-only /auth/login) are refused outside DEBUG: they cannot be tied to a revocable credential. API-key clients re-exchange on 401.

post/auth/refresh

Request

Base URL
https://api.getmetacognition.com (the document declares no server; this is the origin it was published from)
Auth
none declared
TypeScript
https://skmtc.dev/metacognition/apis/tex-api/docs/auth/refresh/post.ts
A function with typed inputs. Its response is checked against the schema.

Request body

refresh_tokenstring required

Refresh token

Response

Successful Response

access_tokenstring required

JWT access token

refresh_tokenstring required

JWT refresh token

token_typestring

Token type

expires_ininteger required

Token expiration in seconds

Changes

No recorded changes to this operation across all 1 revision of this API.

Refresh Token

Request

Request body

Response 200OK

Changes

Response