Skip to main content
POST
/
auth
/
token
/
refresh_token
curl -X POST "https://api.vidaplus.com/auth/token/refresh_token" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyQGV4YW1wbGUuY29tIiwiZXhwIjoxNzA5ODI0ODAwfQ.abc123"

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyQGV4YW1wbGUuY29tIiwiZXhwIjoxNzA5ODI4NDAwfQ.xyz789ghi012",
  "token_type": "bearer"
}
Generates a new access token for an authenticated user without requiring password re-entry. This endpoint requires a valid existing access token.

​
Authentication

​
Authorization
string
required
Bearer token from a previous loginFormat: Bearer <access_token>

​
Response

​
access_token
string
required
New JWT access token for authenticating subsequent requests
​
token_type
string
required
Token type, always returns “bearer”
curl -X POST "https://api.vidaplus.com/auth/token/refresh_token" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyQGV4YW1wbGUuY29tIiwiZXhwIjoxNzA5ODI0ODAwfQ.abc123"

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyQGV4YW1wbGUuY29tIiwiZXhwIjoxNzA5ODI4NDAwfQ.xyz789ghi012",
  "token_type": "bearer"
}

​
Usage Notes

  • This endpoint requires an existing valid access token in the Authorization header
  • The new token will contain the same user information (email in the sub claim) as the original token
  • Use this endpoint to maintain continuous authentication without requiring users to re-enter credentials
  • The new token will have a fresh expiration time based on the server’s ACCESS_TOKEN_EXPIRE_MINUTES configuration

​
Best Practices

  1. Proactive Refresh: Refresh tokens before they expire to avoid authentication interruptions
  2. Secure Storage: Store access tokens securely (e.g., in httpOnly cookies or secure storage)
  3. Token Rotation: Replace old tokens with new ones immediately after refresh
  4. Error Handling: Redirect to login if refresh fails (401 error)

​
Error Responses

Status CodeDescription
200Successfully refreshed token
401Invalid or expired token, could not validate credentials

​
Implementation Details

  • The endpoint validates the current token by decoding the JWT and verifying the user exists
  • User information is extracted from the token’s sub (subject) claim containing the email
  • A new token is generated with the same user email and fresh expiration time
  • The original token becomes invalid practice (though technically could still work until its expiration)

Build docs developers (and LLMs) love

Get started for freeTalk to us