Refresh Token

POST/admin/refreshOpen in the API playground →

Info

Issue a new access token using a valid refresh token. Implements token rotation for security.

Request

refresh_tokenstringbodyrequired

Valid refresh token from login

---

Response

successboolean

Whether the refresh succeeded

tokenstring

New JWT access token

refresh_tokenstring

New refresh token (old one is revoked)

expires_atinteger

Access token expiration timestamp

refresh_expires_atinteger

Refresh token expiration timestamp

userobject

User details object

---

Examples

Request

cURL

curl -X POST "https://demo.api.vultlocal.com/api/v1/admin/refresh" \
  -H "Content-Type: application/json" \
  -d '{
    "refresh_token": "rt_abc123xyz..."
  }'

Response

200 Success

{
  "success": true,
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refresh_token": "new_refresh_token_string",
  "expires_at": 1704110400,
  "refresh_expires_at": 1704714400,
  "user": {
    "id": "123",
    "email": "admin@smartpay.sl",
    "first_name": "Admin",
    "last_name": "User",
    "role": "system_admin",
    "status": "active"
  }
}

401 Invalid Token

{
  "success": false,
  "error": "Invalid or expired refresh token",
  "code": "INVALID_TOKEN"
}

---

Token Rotation

Warning

For security, a new refresh token is issued on every refresh:

1. Old refresh token is revoked immediately
2. New refresh token is stored
3. Both new tokens are returned

---

Errors

Status	Code	Description
400	INVALID_REQUEST	Invalid request format
401	INVALID_TOKEN	Invalid or expired refresh token
500	INTERNAL_ERROR	Server error