POST
/
api
/
v1
/
auth
/
refresh
Refresh tokens (rotation)
curl --request POST \
  --url https://api.example.com/api/v1/auth/refresh
import requests

url = "https://api.example.com/api/v1/auth/refresh"

response = requests.post(url)

print(response.text)
const options = {method: 'POST'};

fetch('https://api.example.com/api/v1/auth/refresh', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/auth/refresh",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main

import (
"fmt"
"net/http"
"io"
)

func main() {

url := "https://api.example.com/api/v1/auth/refresh"

req, _ := http.NewRequest("POST", url, nil)

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/auth/refresh")
.asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/auth/refresh")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)

response = http.request(request)
puts response.read_body

Overview

Exchanges a valid refresh token for a new access + refresh pair and invalidates the presented token in the same transaction. Refresh tokens are single-use rotating — the server marks the old row as usedAt = now and links it to the new row via replacedBy. Re-presenting an already-used refresh token is treated as theft: the entire session chain (every refresh token sharing the same sessionId) is revoked and the API returns 401 TOKEN_REVOKED. The access token returned is a fresh RS256 JWT with a 15-minute TTL. The refresh token is a new 256-bit opaque base64url string with a 30-day TTL.

Authentication

None required at the HTTP layer — the refresh token itself is the credential. Do not send Authorization: Bearer ... on this call.

Path parameters

None.

Query parameters

None.

Request body

FieldTypeRequiredAllowed values / ConstraintsExample
refreshTokenstringyes1..2048 chars; the opaque base64url token returned by /auth/login, /auth/verify-email, or a prior /auth/refresh.v8q3xZ0p6rW7sT4uV1nB2cX9yY8mK5jL6hG7fD3eA0c

Example payload

{
  "refreshToken": "v8q3xZ0p6rW7sT4uV1nB2cX9yY8mK5jL6hG7fD3eA0c"
}

Response — 200 OK

FieldTypeNotes / Allowed valuesExample
accessTokenstringRS256 JWT, 15-min TTL. Pass in Authorization: Bearer <accessToken>.eyJhbGciOiJSUzI1NiIs...
refreshTokenstringNew 256-bit opaque base64url token, 30-day TTL. Replaces the token sent in the request body.qK9wM2lP8oU5tV1nB2cX9yY8mK5jL6hG7fD3eA0c-aR4

Example response

{
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refreshToken": "qK9wM2lP8oU5tV1nB2cX9yY8mK5jL6hG7fD3eA0c-aR4"
}

Error responses

StatusCodeMeaning
400VALIDATION_FAILEDBody malformed or refreshToken missing / outside the 1..2048 char range.
401UNAUTHENTICATEDRefresh token does not match any row, is expired, or fails the shape check (length < 32 or > 256).
401TOKEN_REVOKEDRefresh-token reuse detected (the row was already marked usedAt) — the entire session chain has been revoked. The client must redirect the user to login.

Example error — 401

{
  "type": "https://api.swappr.co.uk/errors/token-revoked",
  "title": "Token revoked",
  "status": 401,
  "code": "TOKEN_REVOKED",
  "detail": "Refresh-token reuse detected; session revoked",
  "instance": "/api/v1/auth/refresh",
  "requestId": "01HZQ7K3M4N5P6Q7R8S9T0V1W2"
}

Side effects

  • Marks the presented refresh_tokens row with usedAt = now and replacedByTokenId = <new id>.
  • Inserts a new refresh_tokens row sharing the same sessionId and deviceFingerprint.
  • On reuse detection, calls revokeAllForSession(sessionId) — every refresh token for that session is revoked.

See also

  • Authentication — full token lifecycle.
  • Login — issues the initial token pair.
  • Logout — revoke the current session’s refresh token.
  • Errors — stable error code catalog.

curl

curl -X POST https://api.swappr.co.uk/api/v1/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{
    "refreshToken": "v8q3xZ0p6rW7sT4uV1nB2cX9yY8mK5jL6hG7fD3eA0c"
  }'