POST
Refresh tokens
When the ID token is about to expire (or a call returns 401), exchange the refresh_token for a fresh id_token and access_token. The lifetimes shape your client’s refresh loop: A login returns these tokens:
Not for SSO sessions. If your users sign in through your own identity provider, refresh at your program’s token URL instead — see SSO tokens.
Keep using the same refresh token. Refreshing doesn’t give you a new one; the response returns your existing refresh_token unchanged, so store it once and reuse it.

Headers

x-program-id
string
required

Identifies the program. Can also be sent as the programId query parameter.

Body

application/json
refresh_token
string
required

Response

Tokens

success
boolean
Example:

true

data
object

Returned when login is fully complete.