import { createAdminClient } from '@spree/admin-sdk'

const client = createAdminClient({
  baseUrl: 'https://your-store.com',
  secretKey: 'sk_xxx',
})

// Driven entirely by the HttpOnly refresh-token cookie + CSRF header (set by the SDK).
const auth = await client.auth.refresh()

spree api post /auth/refresh

{
  "token": "eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJ1c2VyX3R5cGUiOiJhZG1pbiIsImp0aSI6ImFiN2M4YjAxLTY0MGYtNDJhZi1hZTY1LTQxY2NmOTk1YmVlMCIsImlzcyI6InNwcmVlIiwiYXVkIjoiYWRtaW5fYXBpIiwiZXhwIjoxNzY4NDc4NzAwfQ.oXS2FwkI2rK4WOX4QUNW4oTPu7gzMmB9Y9oqsJpW7SY",
  "user": {
    "id": "adm_UkLWZg9DAJ",
    "email": "admin@example.com",
    "first_name": "Clarine",
    "last_name": "Jenkins",
    "full_name": "Clarine Jenkins",
    "selected_locale": null,
    "created_at": "2026-01-15T12:00:00.000Z",
    "updated_at": "2026-01-15T12:00:00.000Z",
    "avatar_url": null,
    "roles": [
      {
        "id": "role_UkLWZg9DAJ",
        "name": "admin"
      }
    ],
    "stores": [
      {
        "id": "store_UkLWZg9DAJ",
        "name": "Spree Test Store",
        "code": "spree_1"
      }
    ]
  }
}

{
  "error": {
    "code": "invalid_refresh_token",
    "message": "Refresh token cookie missing"
  }
}