POST/v2/auth/refresh

Refresh the access token

Rotate the HttpOnly refresh cookie into a new access token. The body is ignored.

No tokenAuthority: permitAllhttps://user.aerolink.dev

Sessions stay alive without asking the customer for a password again. The token is rotated on every success. The agency is re-checked on the customer’s own agency — if the storefront is disabled, live sessions die within one access-token lifetime.

cURL

bash

curl -X POST https://user.aerolink.dev/v2/auth/refresh \
  --cookie "refreshToken=…"

Headers

CookierefreshToken

required

Read from the cookie only. A body is ignored.

Cookie

refreshToken

required

Read from the cookie only. A body is ignored.

Request

JSON

{}

Response

200

{
  "message": "Success",
  "data": {
    "accessToken": "eyJhbGciOiJSUzI1NiIs...",
    "expiresIn": 600
  },
  "error": null
}

Response fields

accessTokenstring

New bearer token

expiresInnumber

Lifetime in seconds

`accessToken` string	New bearer token
`expiresIn` number	Lifetime in seconds

Business rules

The account must still be customer-only.
If the agency check fails, the token is not rotated and the cookie is cleared.
No Origin header is needed — the check is keyed on the customer’s agency.

Errors

401UNAUTHORIZED

Cookie missing, unknown, expired, non-customer, or agency check fails. The refreshToken cookie is cleared. All failures look the same.

HTTP	message	When
401	UNAUTHORIZED	Cookie missing, unknown, expired, non-customer, or agency check fails. The refreshToken cookie is cleared. All failures look the same.