Refresh token
Mint a new CI HUB access token using the refresh token returned at exchange.
Renews a session. This is a shared endpoint: the token in provider-authorization
decides which session is renewed.
CI HUB session
Send the CI HUB refresh token returned at exchange in provider-authorization to
mint a new access token and a new refresh token. Authorization carries the current
access token, which may already be expired (only its signature is checked here).
The refresh token's sub must match the access token's sub; cross-user refresh
attempts are rejected.
The new access token is valid for 1 hour, the new refresh token for 30 days.
Replace both cached tokens with the values returned here. The previous access token
is superseded and should be discarded by the client, but stays valid until its
exp; the previous refresh token remains valid until its 30-day clock runs out, so
a slow client switch-over is safe.
Refresh proactively a few minutes before expires_in, or reactively after
receiving cihub-access-token-invalid from any endpoint. Once a refresh token
expires the partner must perform a new exchange.
DAM connection
Send the DAM refresh_token from the login poll in provider-authorization to
renew a DAM connection token. The token also identifies the provider. Some
providers only return a new access_token; in that case keep the prior
refresh_token and reuse it on the next refresh. A provider with no refresh path
returns 404: run a fresh DAM login. Handle every provider the same way: try to
refresh, and fall back to a fresh login if the refresh fails.
The CI HUB SDK subscription is re-checked on every refresh; partners whose subscription lapsed receive 402 here and must contact CI HUB before continuing.
Authorization
CIHubAuth ProviderAuth The CI-HUB JWT token obtained through authentication. Needs to be sent in the Authorization header.
In: header
Provider-specific authentication token for accessing the provider's services. Needs to be sent in the provider-authorization header with the Bearer prefix.
In: header
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/auth/refreshToken"{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"expires_in": 3600,
"token_type": "Bearer"
}{
"message": "Error",
"details": "POST /api/v1/auth/exchangeToken failed: SDK authentication token is invalid",
"errorCode": "cihub-sdk-token-invalid",
"error": {
"code": "integration-forbidden",
"source": "cihub",
"status": 400,
"message": "Access denied by the integration",
"details": "403 Forbidden - insufficient_permissions",
"provider": "bynder"
}
}{
"message": "Error",
"details": "POST /api/v1/auth/exchangeToken failed: SDK authentication token is invalid",
"errorCode": "cihub-sdk-token-invalid",
"error": {
"code": "integration-forbidden",
"source": "cihub",
"status": 400,
"message": "Access denied by the integration",
"details": "403 Forbidden - insufficient_permissions",
"provider": "bynder"
}
}{
"message": "Error",
"details": "POST /api/v1/auth/exchangeToken failed: SDK authentication token is invalid",
"errorCode": "cihub-sdk-token-invalid",
"error": {
"code": "integration-forbidden",
"source": "cihub",
"status": 400,
"message": "Access denied by the integration",
"details": "403 Forbidden - insufficient_permissions",
"provider": "bynder"
}
}{
"message": "Error",
"details": "POST /api/v1/auth/exchangeToken failed: SDK authentication token is invalid",
"errorCode": "cihub-sdk-token-invalid",
"error": {
"code": "integration-forbidden",
"source": "cihub",
"status": 400,
"message": "Access denied by the integration",
"details": "403 Forbidden - insufficient_permissions",
"provider": "bynder"
}
}When to refresh
The refresh response returns access_token and refresh_token but no expires_in. Track the lifetime from the access token's exp, or from the expires_in returned by the original exchange.
This endpoint also renews DAM connection tokens. The token in provider-authorization decides which session is renewed; see DAM token refresh for that flow.
Example
import { CiHubAccessClient, TokenManager } from '@ci-hub/access-sdk'
const client = new CiHubAccessClient({ baseUrl: 'https://stage.ci-hub.com/api/v1' })
const tokens = new TokenManager(client) // seeded during authentication
// TokenManager refreshes for you: withCihubAuth and withDamAuth always run with a fresh token.
const accessToken = await tokens.cihubAccessToken()
// Or call the endpoint directly, with the pair stored at exchange, and hand
// the renewed session back so later calls use it:
const renewed = await client.refreshToken({
accessToken: ciHubAccessToken,
refreshToken: ciHubRefreshToken,
})
await tokens.setCihubSession({
access_token: renewed.access_token,
refresh_token: renewed.refresh_token ?? ciHubRefreshToken,
})curl "https://stage.ci-hub.com/api/v1/auth/refreshToken" \
-H "Authorization: Bearer $CI_HUB_ACCESS_TOKEN" \
-H "provider-authorization: Bearer $CI_HUB_REFRESH_TOKEN"const response = await fetch(
'https://stage.ci-hub.com/api/v1/auth/refreshToken',
{
headers: {
Authorization: `Bearer ${ciHubAccessToken}`,
'provider-authorization': `Bearer ${ciHubRefreshToken}`,
},
}
)
if (!response.ok) {
const { error } = await response.json()
throw new Error(`${error.code}: ${error.message}`)
}
const { access_token, refresh_token } = await response.json()