Authentication Refresh Token Guide

Latest Update Time: 2026-07-02 00:00:00

Use the refresh token API to get a new access token without asking the user to log in again.

See the Authentication Introduction for base URL, authentication, and required headers.

Endpoint

PUT https://ppapi.qima.com/auth/v2/token

The request body is empty.

Prerequisites

• A previous Get Token or Refresh Token response, providing:
  • The current access token (for the Authorization header)
  • The refreshKey from that response (for the Ai-Api-Refresh-Key header)

Request Example

curl --location --request PUT 'https://ppapi.qima.com/auth/v2/token' \
  --header 'Ai-Api-Access-Token: {your api access token}' \
  --header 'Authorization: Bearer {your token}' \
  --header 'Referer: https://preprodmy.qima.com/' \
  --header 'Ai-Api-Refresh-Key: {your refresh key}'

This API does not use Ai-User-Id — the user identity is already embedded in the Authorization token.

Successful Response

HTTP 200 OK returns a new access token and refresh key.

{
    "message": null,
    "content": {
        "id": "B901DFA7AECA4355854F5B922E3EBB4D",
        "userId": "4C6E94072DFC4918B60752F701DE544A",
        "userType": "client",
        "token": "eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiY3R5IjoiSldUIn0..<truncated-jwt>",
        "validBefore": "1783052501",
        "refreshKey": "e678e8b5de514da39a59a6f48c4b9630",
        "loginType": "Login"
    }
}

Response Field Notes

Field	Notes
id	Session ID for the new token.
userId	QIMA client user login ID the token belongs to.
token	New JWT access token. Use in the Authorization: Bearer <token> header for subsequent requests.
validBefore	Unix timestamp (seconds) the new token expires. Refresh again before this time.
refreshKey	New refresh key. Store this — the old refreshKey is no longer valid after a successful refresh.
loginType	Indicates the login method used for this session, for example "Login" (standard credential login, as opposed to e.g. SSO). Not currently listed in the OpenAPI schema (TokenSession).

Common Errors

Status	Meaning	Recommended Action
500 Internal Server Error	Refresh key invalid. — the refresh key is wrong, expired, or already used.	Log in again via Get Token to obtain a fresh session.

Next Steps

• Use the new token and refreshKey for subsequent API calls and future refreshes.
• Revoke the token when the session should end.