POST/auth/refresh

Refresh an access token

Issues a fresh access token from the secure refresh cookie set at sign-in, and rotates that cookie, keeping the member signed in without asking for the password again.

AccessNo sign-in required

Access tokens expire. Rather than signing in again, call this endpoint with the account id and the sid returned at sign-in. The secure refresh cookie set by POST /auth/login or POST /auth/login-sso travels with the request and is what authorises the exchange, which is why no bearer token is needed here.

Replace your stored token with access_token and use access_token_expires_at to schedule the next refresh. The response also sets a rotated refresh cookie through Set-Cookie: keep the newest one, because the cookie you sent has been rotated out. refresh_token_expires_at is the point past which refreshing stops working and the member signs in again from the beginning.

The refresh cookie has to reach the endpoint

Nothing in the body identifies the session on its own. If your client drops cookies, the call cannot succeed. In cURL, keep a cookie jar from the sign-in call and send it back. In the browser, set credentials: "include". In Rust, build the reqwest client with .cookie_store(true).

Body parameters

user_idnumberrequired

The id of the account the session belongs to. This is uid from the single sign-on response, or UUID inside user_info from a password sign-in.

sidstringrequired

The session id returned at sign-in.

bash

curl -X POST "$SQRL_API/auth/refresh" \
  -H "content-type: application/json" \
  -b sqrl-cookies.txt \
  -c sqrl-cookies.txt \
  -d '{
        "user_id": 4021,
        "sid": "sid_01HZXD5N8V"
      }'

const res = await fetch(`${process.env.SQRL_API}/auth/refresh`, {
  method: "POST",
  headers: { "content-type": "application/json" },
  credentials: "include",
  body: JSON.stringify({
    user_id: 4021,
    sid: "sid_01HZXD5N8V",
  }),
});
const { access_token, access_token_expires_at } = await res.json();

rust

// build the client once with `.cookie_store(true)` so the refresh cookie is kept
let res = client
    .post(format!("{}/auth/refresh", api_base))
    .json(&serde_json::json!({
        "user_id": 4021,
        "sid": "sid_01HZXD5N8V",
    }))
    .send()
    .await?;

Response200 OK

{
"success": true,
"access_token": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI0MDIxIn0.2Vd8p…b41",
"access_token_expires_at": "2026-08-03T09:29:41Z",
"refresh_token_expires_at": "2026-08-10T09:14:22Z"
}

Was this page helpful?