> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hi-doctor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Refresh the access token

> Exchange a valid `refresh` token for a new `access` token. Access tokens are short-lived; refresh rather than storing the password.



## OpenAPI

````yaml /api-reference/openapi.json post /v1/users/token/refresh/
openapi: 3.0.3
info:
  title: Hi-Doctor API
  version: 1.0.0
  description: >-
    Patient-facing REST API for Hi-Doctor.


    Authenticate with email and password to receive a JWT pair, then send the
    access token as `Authorization: Bearer <token>` on every subsequent request.


    Only patient-accessible endpoints are documented here. Clinician and
    back-office endpoints are intentionally omitted.
  contact:
    name: Hi-Doctor
    email: hello@hi-doctor.ai
    url: https://hi-doctor.ai
servers:
  - url: https://api.hi-doctor.ai
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Account
    description: Registration, email verification, sign-in and profile.
  - name: Questionnaires
    description: Complete a consultation questionnaire and submit it for medical review.
  - name: Consultations
    description: Consultations a doctor has reviewed or is reviewing.
  - name: Prescriptions
    description: Prescriptions and reissue requests.
  - name: Billing
    description: Checkout, subscription management and the Stripe billing portal.
  - name: Records
    description: Orders, invoices and side-effect reports.
  - name: Messages
    description: The patient's private thread with their medical team.
  - name: Progress
    description: Weight, injection and note tracking. Requires an active treatment plan.
  - name: Referrals
    description: Referral summary and transactions.
paths:
  /v1/users/token/refresh/:
    post:
      tags:
        - Account
      summary: Refresh the access token
      description: >-
        Exchange a valid `refresh` token for a new `access` token. Access tokens
        are short-lived; refresh rather than storing the password.
      operationId: users_token_refresh_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CustomTokenRefresh'
            example:
              refresh: >-
                eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbl90eXBlIjoicmVmcmVzaCJ9.9Xb2mQ4dLo
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CustomTokenRefresh'
              example:
                access: >-
                  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbl90eXBlIjoiYWNjZXNzIn0.Ksn1w0K6iQ
          description: ''
        '401':
          description: >-
            The refresh token is expired, malformed or already rotated. The
            patient must sign in again.
          content:
            application/json:
              example:
                detail: Token is invalid
                code: token_not_valid
      security: []
components:
  schemas:
    CustomTokenRefresh:
      type: object
      properties:
        refresh:
          type: string
        access:
          type: string
          readOnly: true
      required:
        - access
        - refresh
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Access token from POST /v1/users/token/

````