Reten Docs

Refresh Token

Refresh the access token using the refresh token cookie.

POST /api/auth/refresh

Refresh the access token using the refresh token stored in an HTTP-only cookie. The client does not need to send any body — the refresh token is read from the cookie.

Auth: Public — the refreshToken cookie authenticates the request

Example

curl -X POST https://api.reten.ai/api/auth/refresh \
  -b "refreshToken=eyJhbGciOiJIUzI1NiIs..."
// Cookies are sent automatically by the browser
const response = await fetch("https://api.reten.ai/api/auth/refresh", {
  method: "POST",
  credentials: "include",
});
const data = await response.json();
const accessToken = data.accessToken;
import requests

response = requests.post(
    "https://api.reten.ai/api/auth/refresh",
    cookies={"refreshToken": "eyJhbGciOiJIUzI1NiIs..."},
)
data = response.json()
access_token = data["accessToken"]

Response 201 Created

Same body as login, with roles, permissions and tenantIds read again from the user's current roles:

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "username": "jdoe",
    "email": "jdoe@example.com",
    "firstName": "Jane",
    "lastName": "Doe",
    "roles": ["viewer"],
    "permissions": [
      "project:view",
      "user:view",
      "activity:view",
      "commerce-lifecycle-snapshot:view"
    ],
    "tenantIds": ["660e8400-e29b-41d4-a716-446655440000"]
  }
}

A new refresh token cookie is also set.

Error Responses

StatusDescription
401Invalid or expired refresh token
401The user is deactivated — User account is deactivated