Refresh Token

Refresh an expired access token using a refresh token.


POST /api/auth/refresh

Automatic refresh

You often do not need to call this endpoint on every expiry.

Client style	Behavior
Cookies	Expired access tokens are refreshed using the refresh cookie; new cookies are set on the response.
Headers	Send `Authorization: Bearer <accessToken>` and `X-BSH-REFRESHTOKEN: <refreshToken>`. If the access token is expired, the engine refreshes and completes the original API call. The new access token may appear in `meta.accessToken`.

See Authentication API — Token usage and SDK Auto Refresh.

Request Body


{
  "refresh": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Response


{
  "data": [
    {
      "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
      "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
    }
  ]
}