# Flowg8 · Refresh an access token

Renew access without sending your password again.

Use the refresh token returned by sign-in. No bearer token or organization header is required. Store any returned replacement refreshToken atomically; if none is returned, keep the previous one. Access-token expiry never extends organization membership or administrator rights. If renewal fails with 401, authenticate again. Flowg8 does not store these tokens.

## POST /v1/auth/token

Authentication: public account endpoint; no token required
Required user permissions: No account role required. The API checks current membership, roles, key scopes and resource permissions on every request. Documentation visibility grants no access.

## Input parameters
- grantType (string, required): refresh_token
- refreshToken (string, required): min length 1 · max length 4096

## Request example (replace example IDs)

```sh
curl -X POST "https://api.flowg8.io/v1/auth/token" \
  -H "content-type: application/json" \
  --data-raw '{
  "grantType": "refresh_token",
  "refreshToken": "YOUR_REFRESH_TOKEN"
}'
```

## Response excerpt

```json
{
  "status": "authenticated",
  "tokenType": "Bearer",
  "accessToken": "YOUR_FLOWG8_ACCESS_TOKEN",
  "expiresIn": 3600,
  "expiresAt": "2026-10-17T12:00:00.000Z"
}
```

Source: /docs/refresh-token
Full schemas: /docs/openapi.json