Sessions

Refresh access token

POST/api/v1/auth/refresh-token

Exchanges a valid refresh token for a new access token. On web this reads the refresh token from an httpOnly cookie automatically; mobile clients pass it explicitly.

No authentication required

Session refresh

Body parameters

refreshTokenstring

Required for mobile clients (header x-client-type: mobile). Web clients rely on the refresh-token cookie instead.

Possible errors

401

UNAUTHORIZED

Session invalide ou expirée.

Request

curl --request POST \
  --url https://api.swiftgoma.com/api/v1/auth/refresh-token \
  --header 'Content-Type: application/json' \
  --data '{
  "refreshToken": "eyJhbGciOiJIUzI1NiIsIn..."
}'

200Example response

{
  "success": true,
  "data": {
    "user": {
      "id": "3f2a1c9e-7b41-4e2a-9c31-8e6b2d4f10aa",
      "name": "Aline Mapendo",
      "role": "BUYER",
      "email": "aline@example.com",
      "isEmailVerified": true,
      "phone": "243812345678",
      "isPhoneVerified": false,
      "createdAt": "2026-01-14T10:32:00.000Z"
    }
  }
}