Refresh access and refresh tokens
POST/api/auth/refresh
Issues new tokens using the refresh token from the httpOnly cookie or the request body. The new refresh token is also set as a cookie. Both tokens are rotated on each call: the old refresh token is blacklisted and a new access/refresh pair is issued. The session accessExpiresAt is extended by another 30 minutes. The refresh endpoint queries the database directly (not the Redis cache) and checks two gates: the 36-hour sliding idle window (refreshExpiresAt) and the 7-day absolute session cap (absoluteExpiresAt, stamped once at login and never moved). An expired access token is expected and valid during refresh. New access token expires in 30 minutes; the refresh token slides forward by 36 hours, clamped so it never exceeds the absolute cap. Once the absolute cap has passed, or the idle window has lapsed, refresh is rejected with 401 and the user must sign in again.
Request
Responses
- 200
- 400
- 401
- 429
- 500
Tokens refreshed successfully
Refresh token not provided
Refresh token is invalid, the 36-hour idle window has lapsed ("Session has expired"), or the 7-day absolute cap has been reached ("Session lifetime exceeded, please sign in again"), or the user was disabled by an admin ("Account is disabled", which takes precedence over every session state). In every case the user must sign in again.
Too many token refresh attempts, please try again later
Server error