---
title: "Refresh"
method: POST
path: "/auth/refresh"
tags: ["auth"]
---

# Refresh

`POST /auth/refresh`

## Request

- Base URL: `https://api-v1.unusual.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api-v1.unusual.ai/auth/refresh`
- Auth: none declared

Mint a fresh access token. Cookie first, legacy body token as fallback.

Order matters both ways: the COOKIE is the D10 credential, so it wins when
present and usable; the body token is honored when there is no cookie (a
client on the old bundle) **and** when the cookie is present-but-unusable (a
rotated JWT_SECRET_KEY, a truncated value, a stale cookie from another
environment). Falling back on an unusable cookie is deliberate: the
alternative is a hard lockout for a client that is still holding a perfectly
good refresh token, fixable only by clearing site data.

Whenever the legacy path is taken we plant the cookie — the silent upgrade,
so a user gets cross-host SSO on their next request without re-authenticating.

## Request body

- RefreshRequest
  - `refresh_token` string, nullable

## Response `200`

Successful Response

- TokenPair
  - `access_token` string, required
  - `refresh_token` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/unusual/apis/dashboard-server.md) - [All operations](https://skmtc.dev/unusual/apis/dashboard-server/llms.txt) - [OpenAPI document](https://skmtc.dev/unusual/apis/dashboard-server/revisions/89f716930ead?raw)