---
title: "Refresh the access token"
method: POST
path: "/api/v1/auth/refresh"
tags: ["Auth"]
---

# Refresh the access token

`POST /api/v1/auth/refresh`

## Request

- Base URL: `https://api.proof.holdings`
- URL: `https://api.proof.holdings/api/v1/auth/refresh`
- Auth: API key in cookie `auth_token`

Rotate the dashboard session from its httpOnly refresh cookie. Cookie-authenticated only — an API key neither needs nor can use this. A session whose sign-in was started by a client presenting an API key (see `POST /api/v1/auth/sessions` and `POST /api/v1/accounts`) is renewed only while that key is live; once it is revoked or expired the refresh answers 401 `refresh_token_revoked`. The original sign-in time carries over to the renewed session.

## Response `200`

Session refreshed

- object

## Other responses

- `401`: Refresh token missing, expired or already rotated — or revoked, including because the API key the session is bound to was revoked or expired
- `429`: Rate limited
- `503`: `session_binding_unavailable` — a session bound to an API key could not be renewed with its binding intact; the old refresh token stays valid, try again

---

[API](https://skmtc.dev/proof/apis/proof-holdings-api.md) · [All operations](https://skmtc.dev/proof/apis/proof-holdings-api/llms.txt) · [OpenAPI document](https://skmtc.dev/proof/apis/proof-holdings-api/revisions/b15f506de696?raw)