> ## Documentation Index
> Fetch the complete documentation index at: https://docs.musterbox.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate tokens with a refresh token

> Rotates the access/refresh token pair. The refresh token travels in the
`x-refresh-token` header; the request body is empty (`{}`). Returns a
new `accessToken`, `refreshToken` and `expiresIn` (seconds).




## OpenAPI

````yaml /openapi/musterbox-public.yaml post /api/v1/auth/validate
openapi: 3.0.3
info:
  title: MusterBox Public API
  version: 1.0.0
  description: |
    The public surface of the MusterBox developer platform. Every path in this
    document is verified against the MusterBox backend source code. The client
    SDK (`MusterBoxSdk`) is the recommended way to drive these endpoints; these
    pages document the wire contract for teams that need to understand or
    debug the traffic the SDK produces.

    Environments are selected by the base URL. The control-plane base URL per
    environment is:

    | Environment  | Base URL                          |
    | ------------ | --------------------------------- |
    | `local`      | `http://localhost:8081`           |
    | `sandbox`    | `https://sandbox-api.musterbox.dev` |
    | `staging`    | `https://staging-api.musterbox.dev` |
    | `production` | `https://api.musterbox.com`       |

    All paths below include the `api/v1` backend prefix explicitly, matching
    how the SDK resolves URLs (`control plane base` + `/api/v1`).

    > **Security boundary**: authentication, game sessions and results are the
    > only integration surfaces. Purchase endpoints exist for the on-device
    > PIN-verification flow and should always be driven through the SDK's
    > `PurchaseClient` — never hand-rolled. Do not roll your own purchase flow.
servers:
  - url: https://api.musterbox.com
    description: Production (default)
  - url: https://sandbox-api.musterbox.dev
    description: Sandbox — pre-production validation
  - url: https://staging-api.musterbox.dev
    description: Staging — pre-release integration environment
  - url: http://localhost:8081
    description: Local development backend
security:
  - bearerAuth: []
tags:
  - name: Authentication
    description: Player login, session refresh, and logout via the backend auth API
  - name: Game SDK
    description: >-
      Match sessions and mutually-confirmed results for games hosted by
      MusterBox
  - name: Secure purchases
    description: SDK-mediated PIN sessions for secure player purchases
paths:
  /api/v1/auth/validate:
    post:
      tags:
        - Authentication
      summary: Rotate tokens with a refresh token
      description: |
        Rotates the access/refresh token pair. The refresh token travels in the
        `x-refresh-token` header; the request body is empty (`{}`). Returns a
        new `accessToken`, `refreshToken` and `expiresIn` (seconds).
      operationId: validate
      parameters:
        - name: x-refresh-token
          in: header
          required: true
          description: The refresh token issued at login or by a previous rotation.
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
            example: {}
      responses:
        '200':
          description: Tokens rotated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RefreshResponse'
        '401':
          description: The refresh token is missing, invalid, or expired.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '429':
          description: Rate limit exceeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
components:
  schemas:
    RefreshResponse:
      type: object
      properties:
        accessToken:
          type: string
        refreshToken:
          type: string
        expiresIn:
          type: integer
          format: int64
          description: Access-token lifetime in seconds.
      required:
        - accessToken
        - refreshToken
        - expiresIn
    ApiError:
      type: object
      description: >-
        NestJS error envelope ({ error: { code, message, status } }) or the
        plain { message } shape.
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
            status:
              type: integer
        message:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Player access token returned by login/refresh.

````