Skip to main content

​
GET /api/refresh/refreshtoken

Generates a new access token using a valid refresh token from cookies. This endpoint allows clients to obtain fresh access tokens without requiring the user to log in again.

​
Cookies

​
Response

​
accessToken
string
New JWT access token for API authentication

​
Cookies Set

​
RefreshToken
cookie
The same refresh token is re-set in the cookie to maintain the sessionConfiguration:
  • Same settings as login cookies (8-9 days expiry)

​
Status Codes

  • 200 - New access token generated successfully
  • 400 - Refresh token not received, invalid token, or token expired
  • 404 - User not found
  • 500 - Internal server error

​
Example Request

curl -X GET https://api.deployhub.cloud/api/refresh/refreshtoken \
  -H "Cookie: refreshToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

​
Example Response

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJfaWQiOiI2NzgxMjM0NTY3ODkiLCJ2ZXJpZmllZCI6dHJ1ZSwiaWF0IjoxNzM2Mjg5NjAwLCJleHAiOjE3MzYzMTExMDB9.signature"
}

​
Error Responses

{
  "message": "RefresToken NOt Received"
}

​
Validation Process

  1. Extract refresh token from HTTP-only cookie
  2. Verify JWT signature using REFRESH_TOKEN_SECRET
  3. Retrieve user from database using token payload
  4. Validate that the token matches the one stored in the database
  5. Generate a new access token
  6. Return new access token and refresh the cookie

​
Token Details

New Access Token JWT Payload: 
{
  "_id": "user_id",
  "verified": true,
  "iat": 1736289600,
  "exp": 1736311100
}
Token Expiry:
  • Access Token: 6-10 hours (depends on environment)
  • Refresh Token: 8-9 days (depends on environment)

​
Security Considerations

  • Refresh tokens are stored server-side and validated on each request
  • If the stored refresh token doesn’t match the provided one, the request is rejected
  • This prevents token reuse after logout or token rotation
  • All tokens use HTTP-only cookies to prevent XSS attacks
  • Production tokens use secure: true and sameSite: Strict for enhanced security

​
Usage Pattern

Clients should call this endpoint when:
  1. The access token expires (6-10 hours)
  2. API requests return 401 Unauthorized due to expired access token
  3. Before making authenticated requests if the access token is near expiry

​
Notes

  • The refresh token itself is not rotated in this implementation
  • The endpoint uses GET method (though POST would be more RESTful for token generation)
  • The cookie name in the response is “RefreshToken” (note the capital ‘T’)
  • Refresh token validation is performed by comparing with the database value