Refresh token

Refresh Token

The Refresh Token endpoint allows partners and their applications to obtain a new Bearer access token by submitting a valid refresh token. This eliminates the need to prompt users for credentials every 10 minutes when their access token expires. If the refresh token is invalid, expired, or revoked, the request is rejected and the user must re-authenticate.

Endpoint

POST /api/auth/refresh

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint automatically in your application when the current access token is about to expire or has already expired. Integrating a silent token refresh into your request pipeline ensures uninterrupted API access for end users without requiring them to log in again. If this endpoint returns an error, fall back to a full re-authentication flow via POST /api/auth/v2.

Query Parameters

Parameter	Type	Required	Description
token	string	Yes	The refresh token previously issued by the authentication server

Response

200 OK

Field	Type	Description
token	string	The newly issued Bearer access token
expiration	string (date-time)	UTC date and time when the new token expires
userId	integer (int32)	Internal identifier of the authenticated user

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiration": "2026-06-08T14:35:00Z",
  "userId": 104821
}

Error Codes

Code	When it happens
400	Missing or malformed `token` query parameter
401	Refresh token is invalid, expired, or has been revoked
403	Insufficient permissions to refresh this session
500	Internal server error

Common Mistakes

Passing the access token instead of the refresh token — use the refresh token returned at login, not the short-lived Bearer token
Not URL-encoding the token value in the query string — special characters in the token must be percent-encoded
Ignoring the expiration field in the response and continuing to use the old token instead of replacing it with the new one
Failing to handle 401 responses by falling back to a full re-authentication flow, which leaves users stuck with an expired session

Related Endpoints

POST /api/auth/v2 — Obtain an initial access token and refresh token using username, password, and partnerId
POST /api/auth/logout — Revoke the current session and invalidate the refresh token

Example

curl -X POST "https://api.banking.netevia.dev/api/auth/refresh?token=YOUR_REFRESH_TOKEN" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json"