Rotate the refresh token
Rotates the refresh token and issues a fresh access token. The current `pid_refresh` cookie is **invalidated** and replaced with a new one (rotation), so each refresh token can be used exactly once. - 401 if the refresh token is missing, expired, already rotated, or forged. - Rate limited to 10 requests / minute.
Rotates the refresh token and issues a fresh access token. The current pid_refresh
cookie is invalidated and replaced with a new one (rotation), so each refresh token
can be used exactly once.
- 401 if the refresh token is missing, expired, already rotated, or forged.
- Rate limited to 10 requests / minute.
Response Body
application/json
application/json
curl -X POST "https://example.com/auth/refresh"Log out POST
Revokes the current refresh token and clears both session cookies. Idempotent — safe to call when already logged out.
Client-credentials token for an app backend POST
Machine-to-machine token bound to the app owner's pid, carrying the app's clientId. Use `Authorization: Bearer <token>`. `clientSecret` is required when the app has one set.