curl --request POST \
--url https://api.simpl.gg/v1/auth/refresh \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.simpl.gg/v1/auth/refresh"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.simpl.gg/v1/auth/refresh', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.simpl.gg/v1/auth/refresh",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.simpl.gg/v1/auth/refresh"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.simpl.gg/v1/auth/refresh")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.simpl.gg/v1/auth/refresh")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_at": "2026-09-28T14:00:00Z",
"account": {
"id": "acc_abc123",
"email": "dev@example.com",
"plan": "free",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"name": "Austin"
}
}Refresh the session token
Issues a new 7 day token and invalidates the one used to request it, so a client holds exactly one valid token at a time. Swap the stored token for the new one before making another call. The old token stops working the moment this returns.
curl --request POST \
--url https://api.simpl.gg/v1/auth/refresh \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.simpl.gg/v1/auth/refresh"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.simpl.gg/v1/auth/refresh', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.simpl.gg/v1/auth/refresh",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.simpl.gg/v1/auth/refresh"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.simpl.gg/v1/auth/refresh")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.simpl.gg/v1/auth/refresh")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_at": "2026-09-28T14:00:00Z",
"account": {
"id": "acc_abc123",
"email": "dev@example.com",
"plan": "free",
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"name": "Austin"
}
}Authorizations
Developer session token from POST /v1/auth/login or
POST /v1/auth/register. Valid 7 days.
Authenticates the developer control plane. It also reaches the server
and build endpoints, which a dashboard has to drive and which no
session can otherwise call: an API key's value is returned once, at
mint, so nothing can read back a key for an existing project. On those
endpoints a session names its project with project_id, or is
resolved from the resource it addresses, and is always checked against
the account that owns it.
It reaches no player-facing game endpoint.
Response
A new session. The previous token is now dead.
An authenticated developer session. Send token as
Authorization: Bearer <token> on every developer endpoint.
Tokens last 7 days. POST /v1/auth/refresh issues a new one and
immediately invalidates the token used to request it, so a client holds
exactly one valid token at a time.
JWT bearer token. Store it where a password would go, not in logs.
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
"Bearer"7 days after issue.
"2026-09-28T14:00:00Z"
A developer account. One human, one login, one Stripe customer.
Show child attributes
Show child attributes