---
title: "Refresh access token"
method: POST
path: "/api/auth/refresh"
tags: ["Client"]
---

# Refresh access token

`POST /api/auth/refresh`

Refresh access token using refresh token.
- Web clients: Use httpOnly refresh token cookie with X-CSRF-Token header
- Mobile/Desktop/Server clients: Send refreshToken in request body

## Query parameters

- `client_type` 'web' | 'mobile' | 'desktop' | 'server'

## Headers

- `X-CSRF-Token` string

## Request body

- object
  - `refreshToken` string — Refresh token (required for mobile/desktop/server clients only)

## Response `200`

Token refreshed successfully

- object
  - `user` UserResponse
    - `id` string, uuid
    - `email` string, email
    - `profile` object, nullable — User profile data (name, avatar_url, and custom fields)
      - `name` string
      - `avatar_url` string, uri
    - `metadata` object, nullable — System metadata (device ID, login IP, etc.)
    - `emailVerified` boolean
    - `providers` string[]
    - `createdAt` string, date-time
    - `updatedAt` string, date-time
  - `accessToken` string
  - `csrfToken` string, nullable — New CSRF token for subsequent refresh requests (web clients only)
  - `refreshToken` string, nullable — New refresh token for mobile/desktop/server clients (must be persisted for next refresh)

## Other responses

- `401` — No refresh token provided or user not found
- `403` — Invalid CSRF token

---

[API](https://skmtc.net/insforge/apis/insforge-authentication-api.md) · [All operations](https://skmtc.net/insforge/apis/insforge-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/insforge/insforge-authentication-api/versions/a935bb49f932/schema)