Request Access Token

curl --request POST \
  --url https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token \
  --header 'Content-Type: application/json' \
  --data '
{
  "refreshToken": "<string>"
}
'

import requests

url = "https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token"

payload = { "refreshToken": "<string>" }
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({refreshToken: '<string>'})
};

fetch('https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'refreshToken' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token"

	payload := strings.NewReader("{\n  \"refreshToken\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token")
  .header("Content-Type", "application/json")
  .body("{\n  \"refreshToken\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"refreshToken\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "accessToken": {},
  "refreshToken": "<string>",
  "user": {
    "id": "<string>",
    "foreignId": {},
    "role": "<string>",
    "email": {},
    "name": {},
    "username": {},
    "avatar": {},
    "bio": {},
    "metadata": {},
    "reputation": {},
    "isVerified": {},
    "isActive": {},
    "lastActive": {},
    "suspensions": [
      {}
    ],
    "avatarFile": {},
    "bannerFile": {},
    "authMethods": [
      "<string>"
    ],
    "createdAt": "<string>"
  }
}

POST

:projectId

api

auth

request-new-access-token

Request Access Token

curl --request POST \
  --url https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token \
  --header 'Content-Type: application/json' \
  --data '
{
  "refreshToken": "<string>"
}
'

import requests

url = "https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token"

payload = { "refreshToken": "<string>" }
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({refreshToken: '<string>'})
};

fetch('https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'refreshToken' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token"

	payload := strings.NewReader("{\n  \"refreshToken\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token")
  .header("Content-Type", "application/json")
  .body("{\n  \"refreshToken\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.replyke.com/api/v6/:projectId/api/v7/auth/request-new-access-token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"refreshToken\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "accessToken": {},
  "refreshToken": "<string>",
  "user": {
    "id": "<string>",
    "foreignId": {},
    "role": "<string>",
    "email": {},
    "name": {},
    "username": {},
    "avatar": {},
    "bio": {},
    "metadata": {},
    "reputation": {},
    "isVerified": {},
    "isActive": {},
    "lastActive": {},
    "suspensions": [
      {}
    ],
    "avatarFile": {},
    "bannerFile": {},
    "authMethods": [
      "<string>"
    ],
    "createdAt": "<string>"
  }
}

Exchanges a valid refresh token for a new access token and a new refresh token. This endpoint implements refresh token rotation: every successful call revokes the current refresh token and issues a replacement. Reusing a revoked refresh token is detected as a potential replay attack and results in the entire token family being invalidated.

Body Parameters

string

The refresh token JWT. If omitted or null, the server returns 200 with { user: null, accessToken: null } — indicating no active session. The success and refreshToken fields are absent in this case.

Response

When a valid refresh token is provided, the response is:

boolean

true when a valid refresh token was provided and a new session was issued. This field is absent when no refresh token was submitted.

string | null

New short-lived JWT access token. Expires in 30 minutes. null if no refresh token was provided.

string

New long-lived JWT refresh token (rotated). Expires in 30 days. This field is absent when no refresh token was provided.

object | null

The authenticated user’s full profile, or null if no refresh token was provided.

Show properties

string

Unique user ID (UUID).

string | null

External user ID, if set.

string

User role.

string | null

Email address.

string | null

Display name.

string | null

Username.

string | null

Avatar URL.

string | null

Bio text.

object | null

Public custom data.

number | null

Reputation score.

boolean | null

Whether the user is verified.

boolean | null

Whether the account is active.

string | null

ISO timestamp of last activity.

array

Active suspensions on the account.

object | null

Processed avatar file with variants.

object | null

Processed banner file with variants.

string[]

List of auth methods.

string

ISO timestamp of account creation.

Token Rotation and Reuse Detection

Each call to this endpoint revokes the submitted refresh token and issues a new one. If the same refresh token is submitted again after being revoked:

Within 30 seconds of revocation (grace period): The server returns the successor token to handle concurrent requests gracefully.
After 30 seconds: The entire token family is destroyed and the user must sign in again.

Error Responses

Project Mismatch — 403

{
  "error": "Refresh token does not match this project.",
  "code": "auth/refresh-token-project-mismatch"
}

Token Not Recognized — 403

{
  "error": "Refresh token not recognized.",
  "code": "auth/refresh-token-mismatch"
}

Token Reuse Detected — 401

{
  "error": "Token reuse detected. All sessions in this family have been revoked.",
  "code": "auth/token-reuse-detected"
}

Token Expired or Malformed — 403

{
  "error": "Refresh token is expired or malformed.",
  "code": "auth/refresh-token-malformed"
}

User Not Found — 403

{
  "error": "User not found.",
  "code": "auth/no-user-found"
}

Overview

Auth Endpoints

OAuth Endpoints

User Endpoints

User Follow Operations

User Connection Operations

Follow Endpoints

Connection Endpoints

Entity Endpoints

Comment Endpoints

Chat — Conversations

Chat — Members

Chat — Messages

Collection Endpoints

App Notification Endpoints

Push Notification Endpoints

Report Endpoints

Search Endpoints

Space Endpoints

Space — Membership

Space — Rules

Space — Moderation

Space — Chat

Event Endpoints

Storage Endpoints

Utils

Crypto

Request Access Token

Body Parameters

Response

Token Rotation and Reuse Detection

Error Responses

See Also

​Body Parameters

​Response

​Token Rotation and Reuse Detection

​Error Responses

​See Also

Body Parameters

Response

Token Rotation and Reuse Detection

Error Responses

See Also