> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sagescreen.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Refresh a JWT token pair

> Exchanges an expired (or still-valid) auth token for a new token
pair, provided the refresh window has not elapsed.

Send the current token in the `Authorization: Bearer {token}` header.
The token may already be expired — only the refresh window matters.

**Public endpoint** — no WP nonce required.




## OpenAPI

````yaml /openapi/private/specs/wp/auth.yml get /auth/refresh
openapi: 3.1.0
info:
  title: SageScreen — Auth Module
  description: >
    Authentication and session management. Handles JWT token lifecycle

    (issue, refresh, validate, revoke) and WordPress-based login/logout

    with reCAPTCHA/Turnstile protection.


    Uses RS256-signed JWTs stored in the `wp_sage_screen_jwt` table.

    Tokens have a configurable TTL (`sage_screen_jwt_expires`, default 3600 s)

    and a separate refresh window (`sage_screen_jwt_refresh_expires`, default
    604800 s / 7 days).
  version: 1.0.0
servers:
  - url: https://{domain}/wp-json/sagescreen/v1
    description: WordPress REST API
    variables:
      domain:
        default: api.sagescreen.app
security: []
tags:
  - name: Auth – REST
    description: JWT token endpoints (REST API)
  - name: Auth – AJAX
    description: Session-based login / logout / password flows (AJAX)
paths:
  /auth/refresh:
    get:
      tags:
        - Auth – REST
      summary: Refresh a JWT token pair
      description: |
        Exchanges an expired (or still-valid) auth token for a new token
        pair, provided the refresh window has not elapsed.

        Send the current token in the `Authorization: Bearer {token}` header.
        The token may already be expired — only the refresh window matters.

        **Public endpoint** — no WP nonce required.
      operationId: authRefreshToken
      parameters:
        - name: Authorization
          in: header
          required: true
          schema:
            type: string
            examples:
              - Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
          description: Bearer {token} — the current (possibly expired) auth token
      responses:
        '200':
          description: New token pair issued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenPairResponse'
              example:
                token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
                refresh_token: bmV3IHJlZnJlc2ggdG9rZW4gYmFzZTY0...
        '401':
          description: Token missing, invalid, or refresh window expired
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WPError'
              examples:
                missingToken:
                  summary: No Authorization header
                  value:
                    code: missing_token
                    message: Authorization header with Bearer token required
                    data:
                      status: 401
                refreshExpired:
                  summary: Refresh window elapsed
                  value:
                    code: invalid_refresh_token
                    message: Refresh token expired
                    data:
                      status: 401
                invalidToken:
                  summary: Token cannot be decoded and not found in DB
                  value:
                    code: invalid_token
                    message: Invalid or expired token
                    data:
                      status: 401
        '404':
          description: User not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WPError'
              example:
                code: user_not_found
                message: User not found
                data:
                  status: 404
        '500':
          description: Token refresh failure
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WPError'
              example:
                code: token_refresh_failed
                message: Failed to refresh tokens
                data:
                  status: 500
      security: []
components:
  schemas:
    TokenPairResponse:
      type: object
      required:
        - token
        - refresh_token
      properties:
        token:
          type: string
          description: RS256-signed JWT (see JWTPayload for decoded structure)
          examples:
            - eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
        refresh_token:
          type: string
          description: Base64-encoded 64-byte random refresh token
          examples:
            - dGhpcyBpcyBhIGJhc2U2NCBlbmNvZGVkIHRva2Vu...
    WPError:
      type: object
      description: Standard WordPress REST API error envelope
      required:
        - code
        - message
        - data
      properties:
        code:
          type: string
          description: Machine-readable error code
          examples:
            - missing_credentials
        message:
          type: string
          description: Human-readable error message
          examples:
            - Username and password are required
        data:
          type: object
          required:
            - status
          properties:
            status:
              type: integer
              description: HTTP status code
              examples:
                - 400

````