Refresh #

The Refresh endpoint exchanges a refresh token for a new token pair — a fresh 15-minute access token and a fresh refresh token.

Refresh tokens rotate. The refresh token you redeem is revoked in the process and the response contains its replacement. Always persist the new refresh token; presenting a rotated-away token fails with a 422 and you will have to log in again.

Request #

Curl

curl --location --request POST 'https://api.microbooks.io/auth/v1/refresh' \
--data-raw '{
    "refresh_token": "def50200a1b2c3..."
}'

Python

import requests

url = "https://api.microbooks.io/auth/v1/refresh"
body = {"refresh_token": "def50200a1b2c3..."}

response = requests.post(url, json=body)

print(response.json())

NodeJs

const response = await fetch('https://api.microbooks.io/auth/v1/refresh', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ refresh_token: 'def50200a1b2c3...' })
});
console.log(await response.json());

PHP

$client = new Client();
$body = '{
    "refresh_token": "def50200a1b2c3..."
}';
$request = new Request('POST', 'https://api.microbooks.io/auth/v1/refresh',
    ['Content-Type' => 'application/json'],
    $body
);
$res = $client->sendAsync($request)->wait();
echo $res->getBody();

var client = new RestClient("https://api.microbooks.io/auth/v1/refresh");
var request = new RestRequest(Method.POST);
var body = "{ \"refresh_token\": \"def50200a1b2c3...\" }";
request.AddParameter("application/json", body, ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
Console.WriteLine(response.Content);

Response #

{
    "token_type": "Bearer",
    "expires_in": 900,
    "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...",
    "refresh_token": "def50200d4e5f6..."
}

OAuth clients refresh at the /oauth/token endpoint instead — see the OAuth flow.