zero-auth API Documentation v1.6.0

---

zero-auth API Documentation / extractRefreshToken

Function: extractRefreshToken()

extractRefreshToken(req, cookieName?): string | null

Defined in: packages/zero-auth/src/utils/extractToken.ts:69

Extracts a refresh token with SPA-safe priority:

1. Named refresh cookie (avoids colliding with an access Bearer header),
2. JSON body refreshToken / refresh_token,
3. Authorization: Bearer (API clients that send only the refresh token).

Returns null if no token is found.

Parameters

req

Request

cookieName?

string

Returns

string | null