Refresh Visitor Token

Exchanges a refresh token for a new access token and a new refresh token. Call it when the access token expires, or on page load to restore a session.

POST/v1/auth/refresh

Authentication

Public key?key=pk_…

Public key in the `key` query parameter. No OAuth, no secret.

Edge cache: no-store

Query Parameters

keystring

required

The site's public key (pk_…). It selects the account. Safe to ship to the browser.

Body Parameters

refreshTokenstring

required

The latest refresh token. Each token works once: always store the new one from the response.

Responses

200Success

application/json

typestring

accessTokenstring

refreshTokenstring

expiresInnumber

Errors

401`Sign in required`: the refresh token is missing, unknown, expired, revoked or issued for another site. Send the visitor to the login form.

403The Panda account is not active. The body also carries `code: "TENANT_INACTIVE"`.

Notes

Rotation: the old refresh token stops working and the 60 days start over, so a visitor who keeps coming back stays signed in.
Two tabs refreshing at once, or a response that never arrived, are tolerated for about 2 minutes. Reusing an old token after a newer one was already used revokes the whole session.
Keep the tokens in your own storage and send the access token as `Authorization: Bearer`. The API never sets cookies.

Request

curl --request POST \
  --url "https://api.pandaidx.com/v1/auth/refresh?key={{public_key}}" \
  --header "Content-Type: application/json" \
  --data '{"refreshToken":"example-refresh-token"}'

Response200 OK

{
  "type": "success",
  "accessToken": "v1.example-access-token",
  "refreshToken": "example-refresh-token-2",
  "expiresIn": 3600
}