---
title: "Refresh session token"
method: POST
path: "/auth/refresh"
tags: ["Users"]
---

# Refresh session token

`POST /auth/refresh`

Re-mint the caller's login JWT before it expires (sliding session).

Only user login JWTs are refreshable; permissions and the
``must_change_password`` gate are re-read from the database at re-mint.
Refusal modes: 401 ``session_expired`` once the original authentication is
older than the absolute window (``admin.auth.session_ttl_seconds``), 401
``invalid_credentials`` for deactivated users, non-user tokens, or opaque
(non-JWT) credentials. Clients should then send the user back to login.

## Response `200`

Successful Response

- LoginResponse — JWT token response after successful authentication.
  - `access_token` string, required
  - `expires_in` integer, required
  - `must_change_password` boolean, required
  - `token_type` string, required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `422` — Unprocessable Entity
- `500` — Internal Server Error
- `503` — Service Unavailable

---

[API](https://skmtc.net/jentic/apis/jentic-control-plane-api.md) · [All operations](https://skmtc.net/jentic/apis/jentic-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/jentic/jentic-control-plane-api/revisions/25c23e262a29/schema)