Refresh token
Refresh token
Exchanges the HttpOnly refresh-token cookie for a new access JWT and a rotated refresh cookie. No request body or Authorization header is required — the cookie alone authenticates the call.
The lookup is narrowed by audience, so a refresh token minted for the storefront or the back office cannot be exchanged for a seller session. Membership is rechecked here too: a user whose last seller role was revoked mid-session is refused rather than renewed.
POST
Refresh token

