Skip to main content
POST
Refresh a session

Response

Refresh token rotated; fresh access + refresh cookies set

data
object
required

Session identity returned on verify/refresh/session. The access + refresh tokens are set as httpOnly cookies (not in the body); csrf_token is held in memory by the SPA and echoed in the X-CSRF-Token header.