Exchange a refresh token for a session, optionally acting for an account

Exchange a device-bound refresh token for a new short-lived access token. userId may select an account the authenticated actor is currently authorized to access.

POST /auth/refresh

Exchange a refresh token for a session, optionally acting for an account

cURL

curl --request POST \
  --url https://api.hevn.finance/dapi/v1/auth/refresh \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "userId": "cl_9f2c1ab84d7e4f1fa3c65b0e7d9a2c41"
}
'

200

{
  "accessToken": "<string>",
  "expiresIn": 123,
  "userId": "cl_9f2c1ab84d7e4f1fa3c65b0e7d9a2c41"
}

Authorizations

Authorization · string · header · required

Platform access token from POST /auth/token, carrying the platform audience and the developer_key_id of the registration that minted it. It acts as your own account; name a client you created with X-Hevn-Account: cl_…. Every request re-checks that the registration is still active and that the caller's source IP is inside its allowlist. A token is valid only against the server that issued it, so sandbox tokens are refused in production and production tokens in the sandbox.

Headers

x-api-key · string | null

user-agent · string | null

Body

application/json

userId · string | null

Account to act for; omit it to continue acting as the authenticated account.

Pattern: ^(?:cl_)?[A-Za-z0-9._:\-]{1,216}$

Example:

"cl_9f2c1ab84d7e4f1fa3c65b0e7d9a2c41"

Response

200

application/json

Successful Response

accessToken · string · required

Short-lived bearer token used to authorize API requests.

expiresIn · integer · required

Number of seconds until the access token expires.

userId · string · required

Account selected for the issued session.

Pattern: ^(?:cl_)?[A-Za-z0-9._:\-]{1,216}$

Example:

"cl_9f2c1ab84d7e4f1fa3c65b0e7d9a2c41"