Refresh a session
POST
/v1/auth/refreshExchanges a refresh_token for a new access+refresh pair. Automatic rotation to detect stolen tokens.
This English text was generated automatically from the French original and has not been reviewed yet.
#
Request
Bodysuit
| Parameter | Type | Required | Description |
|---|---|---|---|
refresh_token | string | yes | Refresh token received at signin. Rotation: the token used is invalidated, a new one is issued. |
#
Notes
Theft detection
Attention
If an already used refresh_token is replayed, the entire token family is revoked. The user is forced to log in again.
#
Notes
Distinguish the two 401s
Info
This route is the only one where an 401 can come from two sources: the gateway (API key absent, revoked or expired → code: UNAUTHORIZED) or aura-auth (the refresh token is definitely dead → code: REFRESH_TOKEN_REJECTED). Only destroy the local session on the second one — otherwise a simple rotation of the anon key would disconnect the entire fleet.
v1.0 · revised Apr 15, 2026