Exchange a refresh token for a fresh access + refresh pair
Use when: caller’s access token has expired (or is about to) and they need a new pair — supplying their refresh_token in exchange
Single-use rotation: each refresh token can be exchanged exactly once. Presenting a token that’s already been consumed is treated as a leak signal — the entire refresh-token chain (every token derived from the same root, in either direction) is revoked and the caller is required to re-authenticate via the device flow.
Authorizations
Verlon API key (newly minted keys are prefixed sk-vrln-; legacy verlon_* and layer_* keys from prior prefix migrations continue to validate). Generated from the dashboard under Settings → API Keys, or via verlon key create in the CLI.
Body
Response
New token pair issued.

