> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useautumn.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Refresh

> Exchanges a refresh token (sent as the Bearer credential) for a freshly rotated access + refresh pair. Self-service for the token holder — no secret key required. The previous refresh token is honored for one rotation as a grace window; replaying an older one revokes the customer's tokens.

export const DynamicResponseExample = ({json, statusCode = "200"}) => {
  const toCamelCase = str => {
    return str.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
  };
  const convertKeysToCamelCase = obj => {
    if (Array.isArray(obj)) {
      return obj.map(item => convertKeysToCamelCase(item));
    }
    if (obj !== null && typeof obj === "object") {
      return Object.keys(obj).reduce((acc, key) => {
        const camelKey = toCamelCase(key);
        acc[camelKey] = convertKeysToCamelCase(obj[key]);
        return acc;
      }, {});
    }
    return obj;
  };
  const [isTypeScript, setIsTypeScript] = useState(() => {
    if (typeof window !== "undefined") {
      try {
        const lang = localStorage.getItem("code");
        return JSON.parse(lang) === "typescript";
      } catch {
        return true;
      }
    }
    return true;
  });
  useEffect(() => {
    const onMintlifyStorage = event => {
      if (event.detail?.key === "code") {
        try {
          const value = JSON.parse(event.detail.value);
          setIsTypeScript(value === "typescript");
        } catch {}
      }
    };
    const pollInterval = setInterval(() => {
      try {
        const lang = localStorage.getItem("code");
        const value = JSON.parse(lang);
        setIsTypeScript(value === "typescript");
      } catch {}
    }, 300);
    document.addEventListener("mintlify-localstorage", onMintlifyStorage);
    return () => {
      document.removeEventListener("mintlify-localstorage", onMintlifyStorage);
      clearInterval(pollInterval);
    };
  }, []);
  const camelCaseJson = useMemo(() => convertKeysToCamelCase(json), [json]);
  const snakeCaseString = JSON.stringify(json, null, 2);
  const camelCaseString = JSON.stringify(camelCaseJson, null, 2);
  return <ResponseExample>
			{isTypeScript ? <CodeBlock language="json" filename={statusCode}>
					{camelCaseString}
				</CodeBlock> : <CodeBlock language="json" filename={statusCode}>
					{snakeCaseString}
				</CodeBlock>}
		</ResponseExample>;
};

export const DynamicResponseField = ({children, name, ...props}) => {
  const convertToCamelCase = str => {
    if (typeof str !== "string") return str;
    return str.replace(/[_-](\w)/g, (_, c) => c.toUpperCase());
  };
  const [lang, setLang] = useState(() => {
    if (typeof window !== "undefined") {
      const stored = localStorage.getItem("code");
      return stored || '"typescript"';
    }
    return '"typescript"';
  });
  useEffect(() => {
    const onMintlifyStorage = event => {
      const key = event.detail?.key;
      if (key === "code") {
        setLang(event.detail.value);
      }
    };
    const pollInterval = setInterval(() => {
      const current = localStorage.getItem("code");
      if (current && current !== lang) {
        setLang(current);
      }
    }, 500);
    document.addEventListener("mintlify-localstorage", onMintlifyStorage);
    return () => {
      document.removeEventListener("mintlify-localstorage", onMintlifyStorage);
      clearInterval(pollInterval);
    };
  }, [lang]);
  const resolvedName = useMemo(() => {
    try {
      const value = JSON.parse(lang);
      const useCamelCase = value === "typescript";
      return useCamelCase ? convertToCamelCase(name) : name;
    } catch {
      return name;
    }
  }, [name, lang]);
  return <ResponseField name={resolvedName} {...props}>
			{children}
		</ResponseField>;
};

export const DynamicParamField = ({children, body, path, ...props}) => {
  const convertToCamelCase = str => {
    if (typeof str !== "string") return str;
    return str.replace(/[_-](\w)/g, (_, c) => c.toUpperCase());
  };
  const [lang, setLang] = useState(() => {
    if (typeof window !== "undefined") {
      const stored = localStorage.getItem("code");
      return stored || '"typescript"';
    }
    return '"typescript"';
  });
  useEffect(() => {
    const onMintlifyStorage = event => {
      const key = event.detail?.key;
      if (key === "code") {
        setLang(event.detail.value);
      }
    };
    const pollInterval = setInterval(() => {
      const current = localStorage.getItem("code");
      if (current && current !== lang) {
        setLang(current);
      }
    }, 500);
    document.addEventListener("mintlify-localstorage", onMintlifyStorage);
    return () => {
      document.removeEventListener("mintlify-localstorage", onMintlifyStorage);
      clearInterval(pollInterval);
    };
  }, [lang]);
  const resolvedBody = useMemo(() => {
    try {
      const value = JSON.parse(lang);
      const useCamelCase = value === "typescript";
      return useCamelCase ? convertToCamelCase(body) : body;
    } catch {
      return body;
    }
  }, [body, lang]);
  const resolvedPath = useMemo(() => {
    try {
      const value = JSON.parse(lang);
      const useCamelCase = value === "typescript";
      return useCamelCase ? convertToCamelCase(path) : path;
    } catch {
      return path;
    }
  }, [path, lang]);
  return <ParamField body={resolvedBody} path={resolvedPath} {...props}>
			{children}
		</ParamField>;
};

<Note>
  Exchanges a refresh token for a freshly rotated access + refresh pair. Self-service for the token holder — **no secret key required**. Send the refresh token as the Bearer credential.
</Note>

### How it works

The just-replaced refresh token is honored for one more rotation (a grace window so a dropped response or a second app instance doesn't lock the customer out). Replaying a refresh token that is more than one generation old is treated as theft and revokes the customer's tokens.

<CodeGroup>
  ```typescript TypeScript theme={null}
  // Client configured with the refresh token as its key
  import { Autumn } from "autumn-js";

  const autumn = new Autumn({
    secretKey: JWT_REFRESH_TOKEN,
  });

  const { accessToken, refreshToken } = await autumn.keys.refresh({});
  ```

  ```bash cURL theme={null}
  curl -X POST "https://api.useautumn.com/v1/keys.refresh" \
    -H "Authorization: Bearer am_jwt_<refresh_token>"
  ```
</CodeGroup>

### Response

<DynamicResponseField name="access_token" type="string">
  Access token (1h, or non-expiring if indefinite), prefixed `am_jwt_`.
</DynamicResponseField>

<DynamicResponseField name="refresh_token" type="string">
  Rotating refresh token (24h). Omitted for indefinite tokens.
</DynamicResponseField>

<DynamicResponseField name="expires_at" type="number | null">
  Access-token expiry, ms since epoch. null for indefinite tokens.
</DynamicResponseField>

<DynamicResponseField name="refresh_expires_at" type="number">
  Refresh-token expiry, ms since epoch. Omitted for indefinite tokens.
</DynamicResponseField>

<ResponseExample>
  ```json 200 theme={null}
  {
    "access_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
    "refresh_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
    "expires_at": 1781113864000,
    "refresh_expires_at": 1781196664000
  }
  ```
</ResponseExample>


## OpenAPI

````yaml openapi POST /v1/keys.refresh
openapi: 3.1.0
info:
  title: Autumn API
  version: 2.3.0
servers:
  - url: https://api.useautumn.com
    description: Production server
security:
  - secretKey: []
paths:
  /v1/keys.refresh:
    post:
      tags:
        - keys
      description: >-
        Exchanges a refresh token (sent as the Bearer credential) for a freshly
        rotated access + refresh pair. Self-service for the token holder — no
        secret key required. The previous refresh token is honored for one
        rotation as a grace window; replaying an older one revokes the
        customer's tokens.
      operationId: refreshKey
      parameters:
        - name: x-api-version
          in: header
          required: true
          schema:
            type: string
            default: 2.3.0
          x-speakeasy-globals-hidden: true
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              title: RefreshKeyParams
              description: >-
                No body. The refresh token is supplied as the Bearer credential;
                the response is a freshly rotated access + refresh pair.
              examples:
                - {}
            example: {}
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token:
                    type: string
                    description: >-
                      Access token (1h, or non-expiring if indefinite), prefixed
                      `am_jwt_`.
                  refresh_token:
                    type: string
                    description: >-
                      Rotating refresh token (24h). Omitted for indefinite
                      tokens.
                  expires_at:
                    anyOf:
                      - type: number
                      - type: 'null'
                    description: >-
                      Access-token expiry, ms since epoch. null for indefinite
                      tokens.
                  refresh_expires_at:
                    type: number
                    description: >-
                      Refresh-token expiry, ms since epoch. Omitted for
                      indefinite tokens.
                required:
                  - access_token
                  - expires_at
                examples:
                  - access_token: am_jwt_eyJhbGciOiJIUzI1NiJ9...
                    refresh_token: am_jwt_eyJhbGciOiJIUzI1NiJ9...
                    expires_at: 1781113864000
                    refresh_expires_at: 1781196664000
              example:
                access_token: am_jwt_eyJhbGciOiJIUzI1NiJ9...
                refresh_token: am_jwt_eyJhbGciOiJIUzI1NiJ9...
                expires_at: 1781113864000
                refresh_expires_at: 1781196664000
      x-codeSamples:
        - lang: typescript
          label: Typescript (SDK)
          source: |-
            import { Autumn } from 'autumn-js'

            const autumn = new Autumn()

            const result = await autumn.keys.refresh({});
        - lang: python
          label: Python (SDK)
          source: |-
            from autumn_sdk import Autumn

            autumn = Autumn(secret_key="am_sk_test...")

            res = autumn.keys.refresh(
                request={},
            )
components:
  securitySchemes:
    secretKey:
      type: http
      scheme: bearer
      bearerFormat: JWT

````