Memos

Refresh Token

RefreshToken exchanges the refresh token for a new access token. The refresh token is read from the HttpOnly cookie and rotated: the old token is revoked and a new one with a fresh 30-day expiry is set in the cookie. Public, so it can be called after the access token has expired.

POST
/api/auth/refresh

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request message for AuthService.RefreshToken. It has no fields: the refresh token is read from the HttpOnly cookie.

Response Body

application/json

application/json

curl -X POST "https://example.com/api/auth/refresh" \  -H "Content-Type: application/json" \  -d '{}'
{  "accessToken": "string",  "accessTokenExpireTime": "2019-08-24T14:15:22Z"}

Get Current User

GetCurrentUser returns the authenticated user, similar to OIDC's /userinfo endpoint. When the caller is not signed in or the account is no longer active, clears the refresh token cookie and returns UNAUTHENTICATED.

Sign In

SignIn authenticates a user with password or SSO credentials. On success, returns a short-lived access token and sets a refresh token in an HttpOnly cookie. Public. Attempts are rate limited. Archived users cannot sign in.