Skip to main content
POST
Use a long-lived refresh token (30 days) to silently obtain a new short-lived access token (1 hour) without requiring the user to log in again.

​
When to Use

  • Desktop/iOS native clients whose access token has expired
  • Automated token renewal in background before API calls
  • Any native client that received a refreshToken during login

​
Authentication Flow

If the refresh token is expired or invalid, the endpoint returns 401. The client should clear local auth state and redirect to the login screen.
​
string
required
The refresh token received during login (from /api/auth/jwt or device authorization flow)
​
string
New JWT access token (valid for 1 hour). Usage: Authorization: Bearer <accessToken>
​
number
Token validity in seconds: 3600 (1 hour)