Skip to main content
POST
Refresh access token

Headers

X-CSRF-Token
string

CSRF token received from login/register response (required for web clients only)

Query Parameters

client_type
enum<string>
default:web

Client type determines how refresh tokens are handled:

  • web: Refresh token from httpOnly cookie, requires X-CSRF-Token header
  • mobile/desktop/server: refreshToken provided in request body, new refreshToken returned in response
Available options:
web,
mobile,
desktop,
server

Body

application/json
refreshToken
string

Refresh token (required for mobile/desktop/server clients only)

Response

Token refreshed successfully

user
object
accessToken
string
csrfToken
string | null

New CSRF token for subsequent refresh requests (web clients only)

refreshToken
string | null

New refresh token for mobile/desktop/server clients (must be persisted for next refresh)