---
title: "Exchange a refresh token for a new token pair"
method: POST
path: "/api/v1/refresh"
tags: ["Authentication"]
---

# Exchange a refresh token for a new token pair

`POST /api/v1/refresh`

Uses a valid refresh token to issue a new access token and refresh token pair. The old refresh token is invalidated after use. If token reuse is detected (the same refresh token used more than once), all active sessions are revoked.

## Request body

- object
  - `refresh_token` string, required — Opaque refresh token obtained from login or a previous refresh

## Response `200`

Tokens refreshed successfully

- object
  - `access_token` string, required — New short-lived JWT access token
  - `refresh_token` string, required — New opaque refresh token
  - `token_type` string, required
  - `expires_in` integer, required — Access token TTL in seconds

## Other responses

- `400` — Missing refresh token
- `401` — Invalid or expired refresh token
- `403` — Token reuse detected — all sessions revoked

---

[API](https://skmtc.net/totalpass/apis/token-use.md) · [All operations](https://skmtc.net/totalpass/apis/token-use/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/totalpass/token-use/versions/bc65b4950c7e/schema)