Skip to main content
POST
/
api
/
v1
/
pub
/
{project_id}
/
auth
/
refresh
Refresh tokens
curl --request POST \
  --url https://org-api.hexoforge.dev/api/v1/pub/{project_id}/auth/refresh \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "refresh_token": "<string>"
}
'
{
  "refresh_token": "<string>"
}

Documentation Index

Fetch the complete documentation index at: https://orchestrator-docs.hexoforge.dev/llms.txt

Use this file to discover all available pages before exploring further.

Rotates the refresh token and returns a new access token. Refresh tokens are single-use; the previous refresh token is invalidated. Requires X-API-Key only (no Bearer).

​
Request body

​
refresh_token
string
required
Current refresh token.

​
Response

200 OK 
{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "refresh_token": "bmV3IHJlZnJlc2ggdG9rZW4...",
  "token_type": "bearer",
  "expires_in": 900
}
​
refresh_token
string
New refresh token; store this and discard the old one.

​
Status codes

CodeMeaning
200Rotated successfully
401Invalid, expired, or already-used refresh token
403IP blocked or firewall deny
429Rate limited