---
title: "Exchanges the refresh token for a new access token."
method: POST
path: "/api/auth/refresh"
tags: ["auth"]
---

# Exchanges the refresh token for a new access token.

`POST /api/auth/refresh`

## Request

- Base URL: `https://api.pricklymails.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.pricklymails.com/api/auth/refresh`
- Auth: none declared

## Response `200`

Rotated access token, with fresh refresh and session cookies. A `null` body means no `prickly_refresh` cookie was present; nothing to restore.

- AuthResponse: Response body for authentication endpoints.
  - `access_token` string, required: Access token (JWT), sent as a Bearer credential.
  - `expires_in` integer, required: Access token lifetime in seconds.
  - `user` UserResponse, required: Public representation of a user.
    - `created_at` string, required: Account creation timestamp (ISO 8601).
    - `email` string, required: Email address.
    - `email_verified` boolean, required: Whether the email has been verified.
    - `locale` string, required: Language of the account's emails (`"en"` or `"fr"`).
    - `role` string, required: User role (`"user"` or `"admin"`).
    - `uuid` string, required: Public UUID.

## Other responses

- `401`: Refresh token invalid, expired, or its user no longer exists.

---

[API](https://skmtc.dev/pricklymails/apis/pricklymails-api.md) · [All operations](https://skmtc.dev/pricklymails/apis/pricklymails-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pricklymails/apis/pricklymails-api/revisions/b4225a92d8fb?raw)