Exchange a refresh token for a session, optionally acting for an account

Exchange a device-bound refresh token for a new short-lived access token. userId may select an account the authenticated actor is currently authorized to access.

POST /auth/refresh

Exchange a refresh token for a session, optionally acting for an account

cURL

curl --request POST \
  --url https://api.example.com/auth/refresh \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "userId": "cl_9f2c1ab84d7e4f1fa3c65b0e7d9a2c41"
}
'

200

{
  "accessToken": "<string>",
  "expiresIn": 123,
  "userId": "cl_9f2c1ab84d7e4f1fa3c65b0e7d9a2c41"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

user-agent · string | null

Body

application/json

userId · string | null

Account to act for; omit it to continue acting as the authenticated account.

Pattern: ^(?:cl_)?[A-Za-z0-9._:\-]{1,216}$

Example:

"cl_9f2c1ab84d7e4f1fa3c65b0e7d9a2c41"

Response

200

application/json

Successful Response

accessToken · string · required

Short-lived bearer token used to authorize API requests.

expiresIn · integer · required

Number of seconds until the access token expires.

userId · string · required

Account selected for the issued session.

Pattern: ^(?:cl_)?[A-Za-z0-9._:\-]{1,216}$

Example:

"cl_9f2c1ab84d7e4f1fa3c65b0e7d9a2c41"