Skip to main content
POST https://api.craftkit.dev/v1/embed/sessions/refresh
Rotate a session’s token before it expires. The renewToken is single-use: each call mints a fresh session_token, extends expires_at by 4 hours, and returns a new renew_token — the old one stops working. The response shape is identical to Create a session.

​
Authorization

​
string
required
Bearer ck_live_… — must be an API key from the same project that minted the session.

​
Body

​
string
required
The renew_token from the last mint or refresh (min 8 chars).
Refresh resolves the session by (project, renewToken). A valid key from a different project will not find the session and returns 401 refresh_failed. A renew token that was already rotated, or a session that is no longer active, also returns 401 refresh_failed — re-mint in that case.

​
Response

200 with the rotated session (same fields as the mint response).
​
string
Unchanged — the original session UUID.
​
string
A freshly signed EdDSA JWT.
​
string
Builder URL carrying the new token.
​
string
New ISO-8601 expiry, 4 hours out.
​
string
New single-use renew token; the previous one is invalidated.

​
Errors

cURL
200