---
title: "Refresh Token Endpoint"
method: POST
path: "/api/auth/refresh"
---

# Refresh Token Endpoint

`POST /api/auth/refresh`

## Request

- Base URL: `https://api.yourbeckett.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.yourbeckett.com/api/auth/refresh`
- Auth: none declared

Refresh access token using a refresh token.

Accepts refresh token from httpOnly cookie (web/admin) or request body (iOS).
Implements single-use rotation with theft detection via token families.
Dropped-response recovery: if the replacement session was never used
(auth_used=False), reissue in place instead of revoking the family (#1427).

## Request body

- RefreshRequest
  - `refresh_token` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/yourbeckett/apis/beckett-platform.md) · [All operations](https://skmtc.dev/yourbeckett/apis/beckett-platform/llms.txt) · [OpenAPI document](https://skmtc.dev/yourbeckett/apis/beckett-platform/revisions/a1cb8f2c8961?raw)