Token Refresh

LearnWay uses short-lived JWT Access Tokens (15 minutes to 1 hour) and long-lived Refresh Tokens (7 to 30 days). When an access token expires, clients should send their refresh token to obtain a new pair without forcing the user to log in again.

Refresh Tokens

Endpoint

POST /api/v2/auth/refresh

Request Body

Field	Type	Required	Description
`refreshToken`	`string`	Yes	Valid, unrevoked JWT refresh token

{
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Response (200 OK)

{
  "success": true,
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.newAccess...",
    "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.newRefresh...",
    "expiresAt": "2026-08-22T23:00:00.000Z"
  },
  "message": "Token refreshed successfully"
}

Error Responses

401 Unauthorized: The refresh token is expired, invalid, or has been revoked (e.g. after a password change or logout).
400 Bad Request: Missing refresh token body field.