Stay signed in

Exchange a refresh token for a fresh access token, without asking anybody to sign in again. Call it when an access token has expired, or shortly before. **Send the refresh token, not the access token**, as `Authorization: Bearer <refresh_token>`. You get a new access token and a new refresh token. Store the new pair and throw the old one away: a refresh token works once. If one that has already been used turns up again we treat it as stolen and end that session everywhere, so never keep an old one as a spare. Refreshing also re-checks the account. A user whose account was disabled or deleted since they signed in cannot refresh their way back in.

curl -X POST "https://api.dual.network/auth/refresh-token"

{
  "access_token": "<access token>",
  "refresh_token": "<refresh token>"
}

{
  "code": 3,
  "message": "Key: 'limit' Error:Field validation for 'limit' failed on the 'lte' tag"
}

{
  "code": 16,
  "message": "no auth provided"
}

{
  "code": 13,
  "message": "internal error"
}