I’m not sure about the refreshing documentation. Can I in my client refresh the session without user intervention? E.g. what does

refresh=true

do versus omitting it for

/self-service/login/browser

and

/self-service/login/api

?

Hi @melodic-autumn-17939 Session "refresh" means that the user needs to provide a credential again, e.g. they have an active session, but it now requires proof again by asking the user to enter their password. Yes, you can force a session refresh by having the user navigate to

/self-service/login/browser

with the query parameter

refresh=true

.

What about this part of the question:

E.g. what does

refresh=true

do versus omitting it for

/self-service/login/browser

and

/self-service/login/api

What is the difference when my session is already active? What I’m asking for if is it possible to extend the session without user needs to do anything as long as they have a valid session token. Similar to how OAuth refresh token can be used to get a new access token.

Ory uses tokens (native apps) and cookies (browser apps) to issue sessions. This is also not an OAuth token so you do not have the option of to do a refresh of the token. The

refresh=true

behaves the same for

/self-service/login/browser

and

/self-service/login/api