Admin refresh tokens
Auth
Admin refresh tokens
Rotate the admin refresh token. Returns a fresh access + refresh pair and revokes the presented token.
POST
Admin refresh tokens
Overview
Rotates the admin refresh token. Present a valid, non-revoked, non-expired refresh token; receive a freshaccessToken + refreshToken pair. The presented refresh token is revoked as part of the rotation, so each refresh token is single-use.
Tokens live in the dedicated admin_refresh_tokens collection (separate from the user refresh surface — see Admin auth and MFA).
No authentication header — the refresh token in the body is the credential. There is no burst limiter on this route (unlike
/login and /mfa-verify).Authentication
None. TherefreshToken authenticates the request.
Path parameters
None.Query parameters
None.Request body
| Field | Type | Required | Notes | Example |
|---|---|---|---|---|
refreshToken | string | yes | 1..2048 chars. The opaque refresh token from /admin/auth/mfa-verify or a prior /admin/auth/refresh. | rt_a1b2c3… |
deviceFingerprint | string | no | Max 512 chars. If omitted, the new token inherits the fingerprint of the rotated one. | fp_9a3c… |
Example payload
Response — 200 OK
| Field | Type | Notes | Example |
|---|---|---|---|
accessToken | string | RS256 JWT, scope: 'admin', 15-minute TTL. | eyJhbGciOiJSUzI1NiI… |
refreshToken | string | New opaque 7-day refresh token. The old one is now revoked. | rt_f9e8d7… |
Error responses
| Status | Code | Meaning |
|---|---|---|
| 400 | VALIDATION_FAILED | refreshToken missing or out of length bounds. |
| 401 | ADMIN_REFRESH_TOKEN_INVALID | Token malformed (< 32 chars), not found, already revoked, or expired. The client must re-run the full two-step login. |
Example error — 401 ADMIN_REFRESH_TOKEN_INVALID
See also
- Verify MFA — where the first refresh token is issued.
- Admin logout — explicitly revoke a refresh token.
curl
Postman
Seedocs/postman/swappr.postman_collection.json → Admin Auth → Refresh.