---
title: "Refresh access token"
method: POST
path: "/users/refresh-token"
tags: ["Users"]
---

# Refresh access token

`POST /users/refresh-token`

Reads the refresh_token from an HTTP-only cookie and issues a new
JWT access token if the refresh token is still valid.

## Cookies

- `refresh_token` string, required

## Response `200`

New access token issued

- object
  - `message` string
  - `data` object
    - `token` string — New JWT access token

## Other responses

- `400` — Refresh token missing from cookie
- `401` — Invalid refresh token
- `406` — Refresh token expired
- `500` — Internal server error

## Changes

- **2026-07-13** `d86d0bf8bebe` — 3 info
  - api operation id `refreshAccessToken` was added
  - api tag `Users` added
  - api tag `Authentication` removed
- **2026-07-13** `655215fe8c81` — 3 info
  - api operation id `refreshAccessToken` removed and replaced with ``
  - api tag `Authentication` added
  - api tag `Users` removed
- **2026-06-22** `5878ba786a89` — 3 info
  - api operation id `refreshAccessToken` was added
  - api tag `Users` added
  - api tag `Authentication` removed
- **2026-04-21** `c2977ab99485` — 2 info
  - api tag `Authentication` added
  - api tag `Users - Authentication` removed
- **2026-04-21** `55cdc040840c` — 3 breaking, 7 info
  - added the new required `cookie` request parameter `refresh_token`
  - removed the request body
  - removed the success response with the status `201`
  - api operation id `refreshAccessToken` removed and replaced with ``
  - …6 more

[Full history](https://skmtc.dev/verifywise-ai/apis/verifywise-api/changes/users/refresh-token/post.md)

---

[API](https://skmtc.dev/verifywise-ai/apis/verifywise-api.md) · [All operations](https://skmtc.dev/verifywise-ai/apis/verifywise-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/verifywise-ai/verifywise-api/revisions/d86d0bf8bebe/schema)