Skip to main content

Refresh access token

POST 
/auth/sessions/refresh

Refresh an end-user access token using a refresh token. Authenticated with the publishable application key (X-Application-Key) — no application secret is required, so client-side apps (browser / mobile) can refresh directly. The refresh token is the credential: it must be valid, unexpired, unrevoked, and issued for this application. Refresh tokens are single-use — each refresh returns a NEW refresh token and invalidates the one you presented, so persist the new token before the next refresh. Accepts optional custom_claims to update JWT claims (if not provided, current stored claims are preserved).

Request​

Responses​

Token refreshed successfully