---
title: "POST /api/auth/refresh"
method: POST
path: "/api/auth/refresh"
tags: ["AuthService"]
---

# POST /api/auth/refresh

`POST /api/auth/refresh`

## Request

- The document declares no server URL.
- Auth: none declared

RefreshToken exchanges the refresh token for a new access token.
 The refresh token is read from the HttpOnly cookie and rotated: the old token is revoked and a new one with a
 fresh 30-day expiry is set in the cookie.
 Public, so it can be called after the access token has expired.

## Request body

- RefreshTokenRequest: Request message for AuthService.RefreshToken. It has no fields: the refresh token is read from the HttpOnly cookie.

## Response `200`

OK

- RefreshTokenResponse: Response message for AuthService.RefreshToken.
  - `accessToken` string: The new short-lived access token.
  - `accessTokenExpireTime` string, date-time: When the new access token expires.

## Other responses

- `default`: Default error response

## Changes

- **2026-10-08** `1846a777b0ef`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/usememos/apis/untitled-api/changes/api/auth/refresh/post.md)

---

[API](https://skmtc.dev/usememos/apis/untitled-api.md) - [All operations](https://skmtc.dev/usememos/apis/untitled-api/llms.txt) - [OpenAPI document](https://skmtc.dev/usememos/apis/untitled-api/revisions/f587355e35b4?raw)