> ## Documentation Index
> Fetch the complete documentation index at: https://orchestrator-docs.hexoforge.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Refresh tokens

> Rotate refresh token and obtain a new access token.

Rotates the refresh token and returns a new access token. Refresh tokens are **single-use**; the previous refresh token is invalidated. Requires `X-API-Key` only (no Bearer).

## Request body

<ParamField body="refresh_token" type="string" required>
  Current refresh token.
</ParamField>

## Response

**200 OK**

```json theme={null}
{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "refresh_token": "bmV3IHJlZnJlc2ggdG9rZW4...",
  "token_type": "bearer",
  "expires_in": 900
}
```

<ResponseField name="refresh_token" type="string">
  New refresh token; store this and discard the old one.
</ResponseField>

## Status codes

| Code | Meaning                                         |
| ---- | ----------------------------------------------- |
| 200  | Rotated successfully                            |
| 401  | Invalid, expired, or already-used refresh token |
| 403  | IP blocked or firewall deny                     |
| 429  | Rate limited                                    |