refreshUserInfo

Complete API reference for the api.refreshUserInfo method, refreshing the user's profile data without requiring re-authentication.

The api.refreshUserInfo method refreshes a user's profile data from the provider without requiring them to re-authenticate. This method runs on the server, so it requires you to pass the request or headers object from your server-side context.

refresh-user-info.ts

import { api } from "@/lib/auth"

const output = await api.refreshUserInfo("github", {
  request: getRequest(),
})

Reference

Parameters

Parameter	Type	Required	Description
providerId	`string`	Yes	The id of the OAuth provider to refresh user info from.
options	`RefreshUserInfoAPIOptions`	Yes	An object containing request context.

RefreshUserInfoAPIOptions

Option	Type	Default	Description
request	`Request`	undefined	The request object from the server-side context.
headers	`Headers`	undefined	The headers object from the server-side context.
~~skipCSRFCheck~~	`boolean`	`false`	~~Deprecated~~. This option has been replaced by `doubleSubmitToken` and will be removed in a future release.
doubleSubmitToken	`string`	undefined	Optional CSRF token used to explicitly enable Double-Submit Cookie validation for server-side API functions.

At least one of request or headers is required to construct the incoming URL and validate redirect URLs.

Returns

Return Type	Description
`Promise<RefreshUserInfoAPIReturn<DefaultUser>>`	Resolves to an object containing `success` and `session` — see Behavior.

Behavior

The method uses the provider's existing access token to call its userInfo endpoint, then normalizes the response through the provider's profile function into a User object, and returns the updated session.
The doubleSubmitToken option enables Double-Submit Cookie validation when calling Aura Auth server-side API functions. By default, API functions execute in a trusted server environment, where browser-based CSRF attacks are not possible because requests originate from server-side code rather than from a user's browser. For that reason, Aura Auth performs the standard CSRF validation but skips the additional Double-Submit Cookie verification.

This option is intended for advanced scenarios where server-side requests should enforce the same CSRF guarantees as browser-initiated requests.

Providing doubleSubmitToken does not replace or disable CSRF protection. It enables the additional Double-Submit Cookie validation on top of the standard CSRF checks already performed by Aura Auth.
If the refresh fails (invalid or expired access token, or the provider request fails), session resolves to null and success is false.

Usage

Refresh user info

refresh-user-info.ts

import { api } from "@/lib/auth"

const { success, session } = await api.refreshUserInfo("github", {
  request: getRequest(),
})

console.log("refreshed session:", session)

Handling failure

handle-failure.ts

import { api } from "@/lib/auth"

const { success, session } = await api.refreshUserInfo("github", {
  request: getRequest(),
})

if (!success) {
  redirect("/login")
}

console.log("refreshed session:", session)

Delegating CSRF protection to a different layer

skip-csrf.ts

import { api } from "@/lib/auth"

const { success, session } = await api.refreshUserInfo("github", {
  headers: {
    "x-csrf-token": getCSRFTokenFromRequest(),
  },
  request: getRequest(),
  skipCSRFCheck: false,
})

double-submit.ts

import { api } from "@/lib/auth"

const { success, session } = await api.refreshUserInfo("github", {
  request: getRequest(),
  doubleSubmitToken: getDoubleSubmitTokenFromRequest(),
})

On this page