curl --request POST \
--url https://mcp.echozero.app/api/auth/refresh \
--header 'Content-Type: application/json' \
--header 'x-signature: <x-signature>' \
--header 'x-timestamp: <x-timestamp>' \
--data '
{
"refreshToken": "550e8400-e29b-41d4-a716-446655440000"
}
'{
"success": true,
"data": {
"accessToken": "<string>"
}
}{
"success": false,
"error": {
"code": "NOT_FOUND",
"message": "Resource not found"
}
}Auth
Exchange a refresh token for a new access token
Validates the refresh token server-side against the client’s user agent and returns a fresh JWT access token.
POST
/
api
/
auth
/
refresh
curl --request POST \
--url https://mcp.echozero.app/api/auth/refresh \
--header 'Content-Type: application/json' \
--header 'x-signature: <x-signature>' \
--header 'x-timestamp: <x-timestamp>' \
--data '
{
"refreshToken": "550e8400-e29b-41d4-a716-446655440000"
}
'{
"success": true,
"data": {
"accessToken": "<string>"
}
}{
"success": false,
"error": {
"code": "NOT_FOUND",
"message": "Resource not found"
}
}Headers
Required for API-key authenticated requests. HMAC-SHA256(secretKey, timestamp + METHOD + path + body) as lowercase hex. Omit only for JWT/OAuth session tokens or public routes.
Required with x-signature. Epoch milliseconds; rejected if drift exceeds 5 minutes. Omit only for JWT/OAuth session tokens or public routes.
Body
application/json
OpenAPI schema McpRefreshTokenBodyDto.
Refresh token previously returned from /auth/verify or /auth/social/verify.
Example:
"550e8400-e29b-41d4-a716-446655440000"