POST /api/auth/refresh

Issue a new access token using a valid refresh token.

This endpoint issues a new access token using a refresh token stored in an HTTP-only cookie.

It allows clients to continue authenticated sessions without requiring the user to log in again.

When to use

HTTP

POST /api/auth/refresh

This endpoint does not require a request body.

A valid refresh token must be present as an HTTP-only cookie.

Fetch / Axios

credentials: "include"

Response

{
  "success": true,
  "data": {
    "accessToken": "<new-access-token>"
  }
}

A new access token is returned. The refresh token may also be rotated depending on server configuration.

Error

{
  "success": false,
  "message": "Invalid or expired refresh token"
}

Error

{
  "success": false,
  "message": "Too many requests"
}