Logo

Hover an endpoint and click the pin icon to pin it here.

POSTAccess Token
POSTRefresh Token
v1.0.35
Admin
post
api.monogoto.io/v1/auth/refresh

Refresh Token

Rate limited
5 reqevery 1 minute·keyed byIP address

Obtain new access and refresh tokens using a valid refresh token. This response is not wrapped in the standard envelope.

Token Rotation:

  • The presented refresh token is invalidated after a successful refresh
  • New access and refresh tokens are issued
  • Grace window: the immediately previous refresh token is still accepted for 10 seconds after a rotation (so two browser tabs refreshing at the same moment both succeed); it simply rotates again.
  • Reuse revokes the session: presenting any other already-used refresh token answers 401 and revokes the whole session, so the current refresh token stops working as well and the user must sign in again. Access tokens already issued stay valid until they expire.

Request Body

required

Refresh token to exchange for new tokens

application/json
object
refresh_tokenstring
required

The refresh token obtained during authentication or previous refresh

Responses

Success - Returns new access and refresh tokens (the presented refresh token is now invalid)

application/json
object

Successful authentication response containing JWT tokens

token_typestring
required

Type of token (always Bearer)

enum:"Bearer"
access_tokenstring
required

JWT access token for API authentication. Use in Authorization header as: Bearer <access_token> Token is valid for 4 hours

expires_ininteger
required

Seconds until the access token expires.

refresh_tokenstring
required

JWT refresh token for obtaining new access tokens. Store securely and use when access token expires.

  1. Single-use only (token rotation)
  2. Each token is valid for 24 hours
  3. After successful refresh, this token becomes invalid
  4. New refresh token is issued with each refresh

Related

1
POST

Access Token

/v1/auth/token

Was this page helpful?

/
curl -X POST 'https://api.monogoto.io/v1/auth/refresh' \
  -H 'Content-Type: application/json' \
  -d '{
  "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}'

Success - Returns new access and refresh tokens (the presented refresh token is now invalid)

{
  "token_type": "Bearer",
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 14400,
  "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}