Auth
Refresh
Rotate the refresh cookie and return a new access token. Presenting an already-used refresh token revokes every token from that login.
API key access
This route has its own authentication (or none); an API key is not used here.
curl -X POST "http://localhost:8000/api/v1/auth/refresh"{
"access_token": "string",
"token_type": "bearer",
"expires_in": 0,
"user": {
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"email": "string",
"name": "string",
"created_at": "2019-08-24T14:15:22Z"
}
}Empty
Logout
Revoke the refresh cookie's session (every token from that login) and clear it. Always succeeds, even without a cookie, so clients can call it unconditionally.
Revoke All Sessions
Sign out everywhere (`keep_current: false`, the default; this browser's refresh cookie is cleared) or every other session (`keep_current: true`). Every access token issued so far stops at once (a kept session gets a new one from `/auth/refresh`), and connected apps (OAuth) are signed out too.