Skip to content
go-api-boilerplate

Rotate the session's tokens.

POST
/v1/sessions/refresh
curl --request POST \
  --url https://example.com/api/auth/v1/sessions/refresh \
  --cookie refresh_token=<refresh_token>

Takes the refresh_token cookie and sets new access_token and refresh_token cookies. A refresh token works once: presenting one that was rotated already ends the session. A 401 clears both cookies.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

Refreshed.

Media typeapplication/json
object
session
required
object
id
required
string format: uuid
expires_at
required

When the session ends unless refreshed.

string format: date-time

Example generated

{
  "session": {
    "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
    "expires_at": "2026-04-15T12:00:00Z"
  }
}

Headers

Section titled “Headers”
Set-Cookie
string

Access_token (HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=900) and refresh_token (HttpOnly; Secure; SameSite=Strict; Path=REFRESH_COOKIE_PATH; Max-Age=2592000), or both cleared.

401

Section titled “401”

No refresh cookie, or one that is unknown, expired or reused. Both cookies are cleared.

Media typeapplication/problem+json

An RFC 9457 problem.

object
type
required
string
title
required
string
status
required
integer
detail
string
instance
string
request_id
string
errors
object
key
additional properties
string

Example generated

{
  "type": "example",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "example",
  "request_id": "example",
  "errors": {
    "additionalProperty": "example"
  }
}

Headers

Section titled “Headers”
WWW-Authenticate
string
Set-Cookie
string

Access_token (HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=900) and refresh_token (HttpOnly; Secure; SameSite=Strict; Path=REFRESH_COOKIE_PATH; Max-Age=2592000), or both cleared.

403

Section titled “403”

The token lacks a scope or isn’t the right kind, or the request came from another origin.

Media typeapplication/problem+json

An RFC 9457 problem.

object
type
required
string
title
required
string
status
required
integer
detail
string
instance
string
request_id
string
errors
object
key
additional properties
string

Example generated

{
  "type": "example",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "example",
  "request_id": "example",
  "errors": {
    "additionalProperty": "example"
  }
}

500

Section titled “500”

The service failed; the problem says nothing more.

Media typeapplication/problem+json

An RFC 9457 problem.

object
type
required
string
title
required
string
status
required
integer
detail
string
instance
string
request_id
string
errors
object
key
additional properties
string

Example generated

{
  "type": "example",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "example",
  "request_id": "example",
  "errors": {
    "additionalProperty": "example"
  }
}