1. Docs
  2. API Reference
  3. Refresh access token

Refresh access token

POST/v1/auth/refresh

Rotates the session by reading the admin refresh token from its HttpOnly cookie (the body is ignored) and issuing a new access token plus a new refresh token, preserving the original Account and Application binding. Public but rate-limited to 60 per minute. The old refresh token is revoked on use; presenting an already-revoked token triggers reuse detection that revokes every refresh token for that user. Returns 401 when the cookie is missing, the token is unknown, expired, revoked, or the user or their Account membership is no longer active. New access token is Bearer with a 900s TTL.

Request body

application/json

refresh_tokenstring Optional

Refresh token for backend (BFF) callers that hold the session server-side instead of in the httpOnly cookie. Omit for browser callers — the token is read from the cookie. Requires a matching secret `X-API-Key` to have the rotated token returned in the body.

Responses

application/json

  • dataAuthTokenResponseDto*

application/json

  • errorApiErrorBodyDto*

Returned object

AuthTokenResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/v1/auth/refresh" \
  -H "Content-Type: application/json" \
  -d '{
    "refresh_token": "string"
  }'
Response
{
  "data": {
    "access_token": "string",
    "token_type": "string",
    "expires_in": 0,
    "user": {
      "id": "string",
      "email": "string",
      "first_name": "string",
      "last_name": "string"
    },
    "default_environment_slug": "string"
  }
}
 Related endpoints
POSTRegister a new user
POSTCreate an additional Account for the authenticated admin (no new user)
GETReview the parked account-creation intent before resuming
POSTResume a deferred account creation parked at the register form
DELETEDismiss the parked account-creation intent without creating anything
POSTLook up invite details by token
POSTAccept an invite
POSTAuthenticate and receive tokens
POSTSelect an Account from a pre-auth session (multi-Account login)
POSTSwitch the active Application in an authenticated session
POSTLogout and revoke tokens
GETVerify email address
POSTResend verification email
POSTResend verification email by token
POSTRequest password reset
POSTReset password with token
POSTChange password (authenticated)
GETGet current user profile
GETGet current user avatar image
POSTUpload profile avatar
DELETERemove profile avatar
POSTRequest an email-address change
POSTConfirm an email-address change
GETGet current user permissions
GETList the Accounts the current user belongs to
GETList active sessions
DELETERevoke all sessions
DELETERevoke a specific session
 Was this page helpful?

Tell us how we can improve this guide.

Canopy