Changelog: September 2026
What shipped across Jupiter's developer APIs in September 2026. Trigger wallet login gains refresh tokens, and the single-token access_only mode is now on a deprecation path.
Breaking changes
Trigger: the access_only auth mode is deprecatedBreaking
The legacy access_only mode on POST /trigger/v2/auth/verify (a single JWT valid for 24 hours) was deprecated on 2026-07-21 and will be removed in a future release. It is still the default when authMode is omitted, and responses now carry a Deprecation header, so nothing breaks today.
- Send authMode: "access_refresh" on /verify to opt into refresh tokens
- Read accessToken instead of token
- If you do nothing, requests keep working until removal, after which authMode: "access_only" stops being accepted
WTM (what this means) - Move wallet login to the refresh-token flow now. It is a small client change (one request field, plus reading the new response fields) and avoids a forced migration when access_only is switched off.
Trigger
Refresh tokens for wallet login
POST /trigger/v2/auth/verify with authMode: "access_refresh" now returns a 15-minute accessToken plus a rotating refreshToken (with expiresAt and tokenType), instead of a single 24-hour token. Three endpoints manage the session:
- POST /trigger/v2/auth/refresh rotates the refresh token and returns a new access token
- POST /trigger/v2/auth/logout revokes one session (no auth required)
- POST /trigger/v2/auth/logout-all revokes every session for the wallet (Bearer access token)
WTM - Sessions can now be extended without a fresh wallet signature, and revoked on demand. Refresh before expiresAt; on a 401 from a protected route, refresh once and retry, then re-authenticate if the refresh also fails.