Receive Emails: Routes

Refresh Token

Exchange a refresh token for a new access token and a new refresh token. The old pair stops working immediately.

POSThttps://g.sendcorex.com/v1/token/refresh

This route needs no Authorization header. The access token lasts 1 hour and the refresh token lasts 15 days.

The refresh token is single-use. Save the new token and refresh_token before doing anything else, because the old pair is dead as soon as this call succeeds.

Body parameters

refresh_tokenstringrequired
The current refresh token (R.S.C.G.…).

Quick start

import axios from 'axios';

const response = await axios.post(
  'https://g.sendcorex.com/v1/token/refresh',
  {
    refresh_token: "R.S.C.G.xxxxxxxx"
  },
);

console.log(response.data);

Response

{
  "type": "SUCCESS",
  "data": {
    "token": "S.C.G.xxxxxxxx",
    "refresh_token": "R.S.C.G.xxxxxxxx",
    "expires_at": "2026-10-10T09:33:00Z",
    "refresh_expires_at": "2026-10-25T08:33:00Z"
  }
}

Response fields

data.token
The new access token. Send it in the Authorization header.
data.refresh_token
The new refresh token. Use it once, on the next refresh.
data.expires_at
When the access token expires (UTC).
data.refresh_expires_at
When the refresh token expires (UTC).

Refresh automatically

Refresh when a request fails with TOKEN_EXPIRED, and make sure only one refresh runs at a time: the refresh token can be used once.

Node.js

import axios from 'axios';

const api = axios.create({
  baseURL: 'https://g.sendcorex.com',
  validateStatus: () => true, // handle 4xx/5xx ourselves
});

let token = process.env.SENDCOREX_TOKEN;
let refreshToken = process.env.SENDCOREX_REFRESH_TOKEN;

async function refresh() {
  const res = await api.post('/v1/token/refresh', { refresh_token: refreshToken });
  if (res.status !== 200) throw new Error('refresh failed: ' + res.data?.code);
  token = res.data.data.token;
  refreshToken = res.data.data.refresh_token;
  // Persist both values (database / secret store): the old refresh token is dead.
  return res.data.data;
}

// One refresh at a time, because the refresh token is single-use.
let refreshing = null;

export async function callWithRefresh(commands) {
  const send = () => api.post('/v1', { commands }, { headers: { Authorization: token } });

  let res = await send();
  if (res.status === 401 && res.data?.code === 'TOKEN_EXPIRED') {
    refreshing ??= refresh().finally(() => (refreshing = null));
    await refreshing;
    res = await send();
  }
  if (res.status !== 200) throw new Error(res.data?.code ?? 'HTTP ' + res.status);
  return res.data.results;
}

If the refresh fails with INVALID_REFRESH_TOKEN, the pair cannot be recovered. Generate a new token in the dashboard.

Errors

HTTP-level errors return type, code and message. Errors marked CMD come back inside the command result, with HTTP 200.

401INVALID_REFRESH_TOKEN
The refresh token is invalid, expired, revoked or already used. Generate a new token in the dashboard.
429RATE_LIMITED
More than 15 requests/s or 15 in flight for the same IP + mailbox. Wait the number of seconds in Retry-After.
503AUTH_UNAVAILABLE
Authentication is temporarily unavailable. Try again.