API ReferenceGeneratedAuth

Exchange a refresh token for a new pair

Trades the refresh token for a new access token AND a new refresh token. Refresh tokens are SINGLE-USE: the one you send stops working once exchanged, so always store the pair you get back. Presenting a refresh token that has already been exchanged ends the whole session (`SESSION_ENDED`, reason `reused`) — the server reads it as a stolen token. The one exception is a narrow grace window just after an exchange, so two tabs refreshing at the same moment both receive the same current pair; coordinate refreshes anyway. Pass `activeOrgUid` to switch the session into another organization you are an accepted member of. An `Authorization` header on this request is ignored.

POST
/{appUid}/auth/token

Path Parameters

appUid*string

Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/token" \  -H "Content-Type: application/json" \  -d '{    "refreshToken": "string"  }'
{  "accessToken": "string",  "refreshToken": "string",  "activeOrgUid": "string"}

Begin social sign-in

Mints a single-use `state` and returns the provider's authorize URL for the browser to navigate to. Returns JSON rather than a 302 because the caller is an XHR — a redirect would be followed by the fetch, not the window.

Remove a linked sign-in method

Unlinks one provider identity. Refuses to remove the LAST way in — unlinking the only provider on an account with no password would lock the owner out with no recovery path. Hard-deletes, so the same provider account can be linked again later.