USusememos
AuthService

POST /api/auth/refresh

Changed on

RefreshToken exchanges the refresh token for a new access token. The refresh token is read from the HttpOnly cookie and rotated: the old token is revoked and a new one with a fresh 30-day expiry is set in the cookie. Public, so it can be called after the access token has expired.

Request

  • The document declares no server URL.
  • Auth
    none declared

Request body

RefreshTokenRequest required

Request message for AuthService.RefreshToken. It has no fields: the refresh token is read from the HttpOnly cookie.

Response

OK

accessTokenstring

The new short-lived access token.

accessTokenExpireTimestring date-time

When the new access token expires.

Changes