New Access Token

Use this endpoint to obtain a new Access Token when the current one has expired, without requiring the client to sign in again.

Send a valid Refresh Token from Register Client or Login Client. RealtimeX validates it and returns a fresh Access Token so your application can continue calling protected APIs seamlessly.

Call New Access Token when:

• A protected API returns 401 Unauthorized because the Access Token expired.
• Is Logged In fails and you still have a stored Refresh Token.
• Your application wants to renew the session silently in the background.
• You want to avoid forcing the client through a full login flow.

If the Refresh Token is also invalid or expired, redirect the client to Auth → Login Client.

When the Refresh Token is valid, the API returns a new Access Token that you should use for subsequent authenticated requests.

{
  "success": true,
  "message": "New access token",
  "data": {
    "accessToken": "<new_access_token>"
  },
  "error": null
}

Use this flow to recover from an expired Access Token without sending the client back to the login screen.

1. 1

   Detect an Expired Access Token

   When a protected API returns 401 Unauthorized, or Is Logged In fails, treat the Access Token as expired or invalid.

2. 2

   Send the Refresh Token

   Call New Access Token with the stored Refresh Token in the request body. Do not send the expired Access Token.

   jsonCopy

   {
     "refreshToken": "<refresh_token>"
   }

3. 3

   Receive a New Access Token

   On success, the API returns a fresh Access Token. Replace the previous Access Token in your secure storage.

4. 4

   Retry the Original Request

   Continue with protected endpoints using the new Access Token in the Authorization header.

   httpCopy

   Authorization: Bearer <new_access_token>

5. 5

   Fall Back to Login if Needed

   If the Refresh Token is invalid or expired, redirect the client to Login Client to start a new session.

If the Refresh Token is missing, invalid, or expired, token renewal fails.

{
  "success": false,
  "message": "Invalid or expired refresh token",
  "data": null,
  "error": "Unauthorized"
}

• Refresh automatically when you receive 401 Unauthorized from a protected endpoint.
• Store the Refresh Token securely and never expose it in client-side source code or logs.
• Replace the Access Token immediately after a successful refresh — do not keep using the expired token.
• Avoid refreshing on every request. Refresh only when the Access Token is expired or rejected.
• Always send refresh requests over HTTPS to protect credentials in transit.
• If refresh fails, clear the local session and redirect to login.