# Renew the token (https://docs.loybox.com.ar/en/api-reference/autenticacion/renovar-token)



<Endpoint method="POST" path="/v1/auth/refresh" auth="none" />

Returns a new access token from the refresh token obtained when
[verifying the code](https://docs.loybox.com.ar/api-reference/autenticacion/verificar-codigo), without
needing to ask the user for a new code.

It is what makes the session feel continuous: when a call to
[My account](https://docs.loybox.com.ar/api-reference/mi-cuenta) returns `401`, you renew and retry.

## Headers
<Fields>
  <Field name="X-Commerce-Id" type="integer" location="header" required="true">
    Id of the commerce integrating the API. Every response is scoped to this
    commerce.
  </Field>
</Fields>

## Body
<Fields>
  <Field name="refresh" type="string" required="true">
    The refresh token returned by
    [verifying the code](https://docs.loybox.com.ar/api-reference/autenticacion/verificar-codigo).
  </Field>
</Fields>

## Response
<Fields>
  <Field name="access" type="string" required="true">
    The new access token.
  </Field>

  <Field name="expires_in" type="integer | null">
    Seconds the new token stays valid.
  </Field>
</Fields>

```bash
curl -X POST https://loybox-public-api-752998171300.southamerica-west1.run.app/v1/auth/refresh \
  -H "X-Commerce-Id: 87" \
  -H "Content-Type: application/json" \
  -d '{
    "refresh": "eyJhbGciOiJIUzI1NiIs..."
  }'
```

```json
// 200 OK
{
  "access": "eyJhbGciOiJIUzI1NiIs...",
  "expires_in": 3600
}
```

<Callout type="info" title="It does not return a new refresh">
  The response carries only the `access`. The `refresh` you already had is still the
  valid one: keep it and keep using it.
</Callout>

## Errors
| Code  | When                                                                      |
| ----- | ------------------------------------------------------------------------- |
| `401` | The refresh token is invalid or expired.                                  |
| `422` | The `X-Commerce-Id` header is missing, or the `refresh` field is missing. |

A `401` here means the session really ended: you have to
[request a code](https://docs.loybox.com.ar/api-reference/autenticacion/pedir-codigo) again.