---
method: PUT
path: /api/devices/:id/regenerate-token
auth: jwt
area: devices
---
<!-- source: internal/handlers/devices.go:443 DeviceHandler.RegenerateDeviceToken -->

# Regenerate Device Token

Mints a fresh device auth token and returns it together with device-specific
sync URLs. The previous token is invalidated.

For Kobo devices the response includes `sync_urls` (init/markup/bookmark/sync_url);
for KOReader devices it contains the KOReader endpoints.

## Example response

```json example-response
{
  "message": "Token regenerated successfully",
  "auth_token": "dev_abc123...",
  "device": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "device_name": "Kobo Clara",
    "device_type": "kobo",
    "last_sync": null,
    "last_seen": null,
    "sync_enabled": true,
    "auto_sync": true,
    "sync_frequency_minutes": 60,
    "created_at": "2026-10-24T13:57:01Z",
    "device_metadata": null
  },
  "sync_urls": {
    "sync_url": "http://localhost:8765/api/sync/kobo/dev_abc123...",
    "markup": "http://localhost:8765/api/sync/kobo/dev_abc123.../markup",
    "bookmark": "http://localhost:8765/api/sync/kobo/dev_abc123.../bookmark",
    "init": "http://localhost:8765/api/sync/kobo/dev_abc123.../v1/initialization"
  }
}
```

## Errors

| Status | Body | When |
| ------ | ---- | ---- |
| 400 | `{"error": "invalid device ID"}` | malformed id |
| 401 | `{"error": "invalid user ID"}` | no/invalid JWT |
| 403 | `{"error": "access denied"}` | device belongs to another user |
| 404 | `{"error": "device not found"}` | no such device |
| 500 | `{"error": "..."}` | token generation / DB failure |

Notes: HTMX requests get an HTML reload snippet instead of JSON.
`sync_urls` keys differ by device type (Kobo gets the four above; KOReader
gets its own set).