Refresh Token
Refresh an expired or expiring ID token using a refresh token. **Token Refresh Guide:** 1. Monitor ID token expiration (typically 1 hour) 2. Before expiration, call this endpoint with refresh token 3. Receive new ID token and refresh token 4. Update stored tokens with new values 5. Continue using new ID token for API calls **Best Practice:** Refresh tokens proactively before ID token expires.
Request Body
application/json
Request to refresh an ID token
Response Body
application/json
application/json
curl -X POST "https://example.com/v1/auth/refresh" \ -H "Content-Type: application/json" \ -d '{ "refresh_token": "refresh_token_example_abc123def456" }'Successful Refresh
{ "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjE...", "refresh_token": "AOEOulb...", "expires_in": 3600}{ "code": "BAD_REQUEST", "description": "Invalid input"}Exchange Firebase Phone Number Verification token POST
Exchange a Firebase Phone Number Verification (PNV) JWT for a Cowdi custom token. **Flow:** 1. Client completes phone verification via Firebase PNV SDK 2. Send the PNV JWT to this endpoint 3. Receive a Cowdi custom token (one-time use) 4. Sign in with the custom token via `/v1/auth/sign-in` to obtain ID + refresh tokens The PNV token's `sub` claim must contain the verified E.164 phone number. If a Cowdi user with that phone exists, they are signed in. Otherwise a new user is provisioned on the waiting list.
Sign In POST
Exchange a custom token (obtained from /v1/auth/exchange) for ID and refresh tokens. **Authentication Flow:** 1. Exchange partner JWT for custom token via `/v1/auth/exchange` 2. Use custom token to sign in via this endpoint 3. Receive ID token and refresh token 4. Use ID token in Authorization header for API calls 5. Refresh ID token using `/v1/auth/refresh` before expiration **Important:** Custom tokens are one-time use only.