Exchange a refresh token for new tokens

POSThttps://api.testingapis.com/api/auth/jwt/refreshSign in to see this endpoint's URL

Refresh tokens are single use: each call returns a new one and the old one stops working. Presenting a refresh token that was already used is treated as theft: every refresh token from the same login is revoked, so the user has to log in again (reuse detection, RFC 9700).

Request body

Optional. application/json, text/json, application/*+json, application/xml, text/xml, application/*+xml. Model: JwtAuthControllerRefreshRequest. The refresh token to use.

Example body

{"refreshToken": "{{refreshToken}}"}

Responses

200: New access and refresh tokens.
400: refreshToken missing.
401: Refresh token invalid or expired, or already used (which also revokes its whole family).

Example

Request

curl -X POST "https://api.testingapis.com/api/auth/jwt/refresh" \
  -H "Content-Type: application/json" \
  -d '{"refreshToken": "{{refreshToken}}"}' \
  -H "X-TestingApis-Key: YOUR_API_KEY"

Response200 OK

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9uYW1laWRlbnRpZmllciI…
  "tokenType": "Bearer",
  "expiresIn": 900,
  "refreshToken": "jrt_b0f84f4f71e59e3231e4f56ae56a23c7bfa15f77",
  "user": {"username": "user", "role": "user", "name": "Uma User}
}

The parameters, request and response examples and the live Try it panel for this endpoint are for signed-in members. Accounts are free and take a few seconds to create.

Try itSign-in requiredUses your key

api.testingapis.com

curl -X POST 'https://api.testingapis.com/api/auth/jwt/refresh' \
  -H 'Content-Type: application/json' \
  -H 'X-TestingApis-Key: YOUR_API_KEY' \
  -d '{"refreshToken": "{{refreshToken}}"}'

const res = await fetch("https://api.testingapis.com/api/auth/jwt/refresh", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
  body: "{\"refreshToken\": \"{{refreshToken}}\"}",
});
console.log(res.status, await res.text());

const res = await fetch("https://api.testingapis.com/api/auth/jwt/refresh", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
  body: "{\"refreshToken\": \"{{refreshToken}}\"}",
});
const body: string = await res.text();
console.log(res.status, body);

import requests

res = requests.post(
    "https://api.testingapis.com/api/auth/jwt/refresh",
    headers={
        "Content-Type": "application/json",
        "X-TestingApis-Key": "YOUR_API_KEY",
    },
    data="{\"refreshToken\": \"{{refreshToken}}\"}",
)
print(res.status_code, res.text)

using System.Net.Http.Headers;

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.testingapis.com/api/auth/jwt/refresh");
request.Headers.TryAddWithoutValidation("X-TestingApis-Key", "YOUR_API_KEY");
request.Content = new StringContent("{\"refreshToken\": \"{{refreshToken}}\"}");
request.Content.Headers.ContentType = MediaTypeHeaderValue.Parse("application/json");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://api.testingapis.com/api/auth/jwt/refresh"))
                .header("X-TestingApis-Key", "YOUR_API_KEY")
                .header("Content-Type", "application/json")
                .method("POST", HttpRequest.BodyPublishers.ofString("{\"refreshToken\": \"{{refreshToken}}\"}"))
                .build();
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader("{\"refreshToken\": \"{{refreshToken}}\"}")
	req, err := http.NewRequest("POST", "https://api.testingapis.com/api/auth/jwt/refresh", body)
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-TestingApis-Key", "YOUR_API_KEY")
	req.Header.Set("Content-Type", "application/json")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.StatusCode, string(data))
}

Refresh token{{refreshToken}}

POST /api/auth/jwt/login as user / user123.

POSThttps://api.testingapis.com/api/auth/jwt/refresh