Session Refresh Lifecycle
Understand how Meshes embed refreshes session tokens without creating a new logical session every time.
Meshes refreshes embed sessions in place.
Refresh keeps the same session
When you call POST /api/v1/sessions/:sessionId/refresh, the response keeps the same session_id and returns a new access_token.
When refresh happens
The iframe can ask for refresh in two ways:
- scheduled refresh before expiry
- early refresh after an auth-related
401
Expected host behavior
- receive
meshes:token-refresh - refresh the logical session on your backend
- send the new
access_tokenback withmeshes:auth
What refresh does not do
Refresh does not mint a new launch URL. It is meant for an already-mounted iframe.
If you need a full iframe bootstrap again, mint a fresh session and use the new launch_url.