Skip to main content
Start with Authentication for the initial sign-in flow. This page covers what to do after a user session already exists.
Access tokens expire. When a protected request returns 401, use the stored refresh token to get a new access token without sending the user through sign-in again. When the SDK client is configured with authDelivery: "cookie-refresh", refreshAccessToken() still works, but the refresh token comes from the API’s HttpOnly cookie instead of local storage. The cookie stays scoped to the AGG API host and /auth routes only.

Manual refresh

Wrap protected calls

React to sign-out

When refresh fails, clear the session and send the user back through authentication:
If you are also streaming authenticated WebSocket events, refresh the REST session first and then re-authenticate or reconnect the socket. See User Notifications.