API ReferenceAuth

Refresh a session

Trades the refresh token for a new access token AND a new refresh token. Refresh tokens are SINGLE-USE: the one you send stops working once exchanged, so always store the pair you get back. Presenting a refresh token that has already been exchanged ends the whole session (`SESSION_ENDED`, reason `reused`) — the server reads it as a stolen token. The one exception is a narrow grace window just after an exchange, so two tabs refreshing at the same moment both receive the same current pair; coordinate refreshes anyway. Pass `activeOrgUid` to switch the session into another organization you are an accepted member of. An `Authorization` header on this request is ignored.

POST
/{appUid}/auth/token

Path Parameters

appUid*string

Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/token" \  -H "Content-Type: application/json" \  -d '{    "refreshToken": "string"  }'
{  "accessToken": "string",  "refreshToken": "string",  "activeOrgUid": "string"}

Finish social sign-in

The provider callback redirects the browser back with a two-minute single-use hand-off code — never a JWT, which in a URL would land in browser history, referrer headers and proxy logs. This trades that code for the real session, and only the app it was minted for may redeem it.

Sign out

Ends the session the presented token belongs to: its refresh token and all of its access tokens stop working immediately. Send the refresh token as `refreshToken` in the body (preferred — it works after the access token has expired), or the access token as `Authorization: Bearer <token>`. When a body refresh token is present, the header is ignored. Idempotent: signing out of a session that has already ended returns 200.