auth.refresh
public
Exchange a refresh token for a new token pair
Rotates the token pair. Refresh tokens slide on each use up to a 90-day absolute session cap, after which the user must log in again.
Parameters
Passed by name in the params object.
| Name | Type | Required | Description |
|---|---|---|---|
refresh_token |
string | yes | A refresh token from a prior auth.login or auth.refresh |
Result
Returns tokenPairResult:
| Field | Type | Description |
|---|---|---|
access_expires_at * |
string | RFC3339 expiry of the access token |
access_token * |
string | Short-lived bearer token (15-minute TTL); send as Authorization: Bearer <token> |
refresh_token * |
string | Long-lived token used with auth.refresh to obtain a new pair |
user * |
userDTO |
Errors
| Code | Message | When |
|---|---|---|
1001 |
unauthorized |
Missing/invalid credentials or a throttled login. |
1002 |
token_expired |
The access token expired; refresh and retry. |
2002 |
validation_failed |
Malformed request; see error.data. |
See the error reference for the full catalog, including the authentication codes.
Example
Request:
{
"jsonrpc": "2.0",
"id": 1,
"method": "auth.refresh",
"params": {
"refresh_token": "eyJhbGciOiJIUzI1NiJ9.eyJ0eXAiOiJyZWZyZXNoIn0.Zm9vYmFy"
}
}
Response:
{
"jsonrpc": "2.0",
"id": 1,
"result": {
"access_token": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIwMThmM2E1Yy0xYzdhLTdlM2IifQ.c2ln",
"refresh_token": "eyJhbGciOiJIUzI1NiJ9.eyJ0eXAiOiJyZWZyZXNoIn0.c2ln",
"access_expires_at": "2026-03-14T09:41:53Z",
"user": {
"id": "018f3a5c-1c7a-7e3b-9c2a-3f4b5a6c7d8e",
"email": "ada.lovelace@example.com",
"is_admin": false
}
}
}
curl
curl -s https://peinture.gumeniuk.com/rpc \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"auth.refresh","params":{"refresh_token":"eyJhbGciOiJIUzI1NiJ9.eyJ0eXAiOiJyZWZyZXNoIn0.Zm9vYmFy"}}'
JavaScript
const res = await fetch("https://peinture.gumeniuk.com/rpc", {
method: "POST",
headers: {
"Content-Type": "application/json",
},
body: JSON.stringify({
jsonrpc: "2.0", id: 1, method: "auth.refresh", params: {"refresh_token":"eyJhbGciOiJIUzI1NiJ9.eyJ0eXAiOiJyZWZyZXNoIn0.Zm9vYmFy"},
}),
});
const { result, error } = await res.json();
Go
body := []byte(`{"jsonrpc":"2.0","id":1,"method":"auth.refresh","params":{"refresh_token":"eyJhbGciOiJIUzI1NiJ9.eyJ0eXAiOiJyZWZyZXNoIn0.Zm9vYmFy"}}`)
req, _ := http.NewRequest("POST", "https://peinture.gumeniuk.com/rpc", bytes.NewReader(body))
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)