> ## Documentation Index
> Fetch the complete documentation index at: https://docs.korve.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Refresh Session

> Atomically consume one refresh token and rotate both session tokens; reuse revokes the session.



## OpenAPI

````yaml /openapi.json post /v1/apps/{projectId}/auth/refresh
openapi: 3.1.0
info:
  title: Korve API
  version: 0.1.0
  description: >-
    Typed control plane for deploying applications and explicitly provisioning
    their managed infrastructure.
servers:
  - url: https://api.korve.dev
security: []
paths:
  /v1/apps/{projectId}/auth/refresh:
    post:
      tags:
        - appauth
      summary: Refresh Session
      description: >-
        Atomically consume one refresh token and rotate both session tokens;
        reuse revokes the session.
      operationId: appauth.refreshSession
      parameters:
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: The project id (UUID) or globally unique project slug.
      requestBody:
        required: true
        x-korve-max-bytes: 1048576
        content:
          application/json:
            schema:
              type: object
              properties:
                refreshToken:
                  type: string
              required:
                - refreshToken
              additionalProperties: false
      responses:
        '200':
          description: Rotated app session.
          content:
            application/json:
              schema:
                type: object
                properties:
                  accessToken:
                    type: string
                    description: >-
                      Short-lived opaque bearer token. Only a SHA-256 digest is
                      stored by Korve.
                  refreshToken:
                    type: string
                    description: >-
                      One-time rotating token. Only a SHA-256 digest is stored
                      by Korve.
                  expiresAt:
                    type: string
                    format: date-time
                  user:
                    type: object
                    properties:
                      id:
                        type: string
                      email:
                        type: string
                        format: email
                      emailVerified:
                        type: boolean
                      name:
                        type:
                          - string
                          - 'null'
                      image:
                        type:
                          - string
                          - 'null'
                      disabledAt:
                        type:
                          - string
                          - 'null'
                        format: date-time
                      createdAt:
                        type: string
                        format: date-time
                      lastSignInAt:
                        type:
                          - string
                          - 'null'
                        format: date-time
                      lastActiveAt:
                        type:
                          - string
                          - 'null'
                        format: date-time
                    required:
                      - id
                      - email
                      - emailVerified
                      - name
                      - image
                      - disabledAt
                      - createdAt
                      - lastSignInAt
                      - lastActiveAt
                required:
                  - accessToken
                  - refreshToken
                  - expiresAt
                  - user
        '401':
          description: Invalid, expired, reused, revoked, or cross-project refresh token.
        '429':
          description: Too many refresh attempts.
      security: []

````