Sign in

v1

latestOpenAPI 3.0.32026-07-26172157253.6 KB
Client

Refresh access token

Refresh access token using refresh token.

  • Web clients: Use httpOnly refresh token cookie with X-CSRF-Token header
  • Mobile/Desktop/Server clients: Send refreshToken in request body
post/api/auth/refresh

Query parameters

client_type'web' | 'mobile' | 'desktop' | 'server'

Client type determines how refresh tokens are handled:

  • web: Refresh token from httpOnly cookie, requires X-CSRF-Token header
  • mobile/desktop/server: refreshToken provided in request body, new refreshToken returned in response

Headers

X-CSRF-Tokenstring

CSRF token received from login/register response (required for web clients only)

Request body

refreshTokenstring

Refresh token (required for mobile/desktop/server clients only)

Response

Token refreshed successfully

accessTokenstring
csrfTokenstring nullable

New CSRF token for subsequent refresh requests (web clients only)

refreshTokenstring nullable

New refresh token for mobile/desktop/server clients (must be persisted for next refresh)