Skip to main content

Version: v1

Refresh Access Token

Generate a new access token using the refresh token that was set as an HTTP-only cookie during login. This endpoint helps maintain user sessions without requiring re-authentication.

HTTP Method & Endpoint​

GET | /auth/refresh/{storeId}

Path Parameter​

ParameterTypeRequiredDescription
storeIdStringYesStoreId (replace {storeId} with your actual storeId)

Request​

Headers​

HeaderValueDescription
Content-Typeapplication/jsonSpecifies that the request body is in JSON format
x-store-id{storeId}StoreId (replace {storeId} with your actual storeId)
Cookie__Secure-unisouk.{storeId}.refresh-token={token}HTTP-only refresh token cookie (set by the server; inaccessible to JavaScript)

Important Notes:​

  1. The refresh token cookie is automatically set by the Login API upon successful authentication
  2. The cookie is HTTP-only and Secure, making it inaccessible to client-side JavaScript
  3. The cookie name follows the pattern: __Secure-unisouk.{storeId}.refresh-token
  4. The access tokens have short expiration times (ie 15 minutes)

Response Format​

Success Response (200 OK)​

{
  "message": "Refresh Success.",
  "data": {
    "customer": {
      "id": "2342341293912113",
      "storeId": "2342341293912313",
      "email": "abc@gmail.com",
      "mobileNumber": null,
      "emailVerified": "2025-05-16T06:26:16.513Z",
      "mobileVerified": null,
      "status": "ACTIVE",
      "createdAt": "2025-05-16T06:25:36.043Z",
      "updatedAt": "2025-05-16T06:26:16.514Z"
    },
    "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImtleV9Udm1iWVUyWEdiSDk0TnpaIn0...."
  },
  "source": "db"
}

Data properties​

FieldTypeDescription
accessTokenStringNew JWT access token
customerCustomerContains all details about the authenticated user

Customer Properties​

FieldTypeDescriptionFormat/Values
idStringUnique identifier for the customerBigInt( eg. 2342341293912313)
storeIdStringUnique identifier of the associated storeBigInt( eg. 2342341293912313)
emailStringCustomer's email addressValid email format
emailVerifiedStringTimestamp when the email was last verifiedISO 8601 format (e.g., "2025-05-16T06:26:16.514Z")
statusEnumCurrent status of the customer accountACTIVE or INACTIVE
createdAtStringTimestamp when the customer account was createdISO 8601 format (e.g., "2025-05-16T06:26:16.514Z")
updatedAtStringTimestamp when the customer account was last updatedISO 8601 format (e.g., "2025-05-16T06:26:16.514Z")

Notes:

  1. All timestamp fields use ISO 8601 format with millisecond precision and UTC timezone (Z suffix)
  2. The status field is restricted to two possible values: ACTIVE or INACTIVE
  3. The emailVerified field will be null if the email hasn't been verified

Examples​

cURL​

curl -X POST "https://dev-sfapi.unisouk.com/auth/refresh/<STORE_ID>" \
  -H "Content-Type: application/json" \
  -H "x-store-id: <STORE_ID>" \
  -H "Cookie: __Secure-unisouk.<STORE_ID>.refresh-token=<REFRESH_TOKEN>" \
  --data ''

JavaScript (React)​

Since the refresh token is HTTP-only, browser JavaScript cannot directly access it. Instead, you should:

  1. Create a wrapper function that handles token refresh automatically
  2. Let the browser automatically include the cookie
// Example using axios interceptors
import axios from "axios";

const api = axios.create({
  baseURL: "https://dev-sfapi.unisouk.com",
});

api.interceptors.response.use(
  (response) => response,
  async (error) => {
    const originalRequest = error.config;

    if (error.response.status === 401 && !originalRequest._retry) {
      originalRequest._retry = true;

      try {
        // The cookie will be sent automatically
        const { data } = await axios.post(
          `/auth/refresh/${getstoreId()}`,
          {},
          {
            headers: {
              "x-store-id": getstoreId(),
            },
          }
        );

        // Store new access token
        localStorage.setItem("accessToken", data.data.accessToken);

        // Retry original request
        originalRequest.headers.Authorization = `Bearer ${data.data.accessToken}`;
        return api(originalRequest);
      } catch (refreshError) {
        // Handle refresh token failure (redirect to login)
        window.location.href = "/login";
        return Promise.reject(refreshError);
      }
    }

    return Promise.reject(error);
  }
);

Error Responses​

Status CodeError TypeDescription
400BadRequestExceptionInvalid customer ID or missing store ID header
401UnauthorizedExceptionInvalid or expired refresh token
403ForbiddenExceptionAccount inactive or suspended
404NotFoundExceptionCustomer record not found
500InternalServerErrorServer error during token generation

Sample Error Response​

{
  "requestId": "c7d4e5f6-g8h9-i1j2-k3l4-m5n6o7p8q9r0",
  "error": "UnauthorizedException",
  "statusCode": 401,
  "message": "Refresh token expired",
  "path": "/auth/refresh/2342341293912313",
  "timestamp": 1747838047845
}