Authentication
Refresh session token
Exchange a refresh token for a new access token + refresh token pair.
When to call this:
- Before the access token expires (check
expires_infrom sign-in response) - On a 401 response from any authenticated endpoint
- Recommended: refresh when 80% of
expires_inhas elapsed
Flow:
- Sign in → get
session_id(access token) +refresh_token+expires_in - Store both tokens
- Use
session_idas Bearer token for API calls - Before it expires, call
POST /auth/refreshwith therefresh_token - Replace both tokens with the new ones from the response
- Repeat
Important:
- Each refresh token can only be used once (within the reuse interval)
- After refreshing, the old refresh token is invalidated
- If the refresh token is expired or invalid, the user must sign in again
POST
Refresh session token
Related topics
Partner integrationsVerify an OAuth session (Google sign-in)Create a firm-scoped partner sessionConfirm password reset with tokensSign in with email and password