diff --git a/pkg/swagger/docs.go b/pkg/swagger/docs.go
index a23873db0..170924487 100644
--- a/pkg/swagger/docs.go
+++ b/pkg/swagger/docs.go
@@ -6627,6 +6627,26 @@ const docTemplate = `{
                 }
             }
         },
+        "/user/logout": {
+            "post": {
+                "description": "Destroys the current session and clears the refresh token cookie.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "auth"
+                ],
+                "summary": "Logout",
+                "responses": {
+                    "200": {
+                        "description": "Successfully logged out.",
+                        "schema": {
+                            "$ref": "#/definitions/models.Message"
+                        }
+                    }
+                }
+            }
+        },
         "/user/password": {
             "post": {
                 "security": [
@@ -7447,7 +7467,7 @@ const docTemplate = `{
         },
         "/user/token": {
             "post": {
-                "description": "Returns a new valid jwt user token with an extended length.",
+                "description": "Returns a new valid jwt link share token. Only works for link share tokens.",
                 "consumes": [
                     "application/json"
                 ],
@@ -7455,9 +7475,9 @@ const docTemplate = `{
                     "application/json"
                 ],
                 "tags": [
-                    "user"
+                    "auth"
                 ],
-                "summary": "Renew user token",
+                "summary": "Renew link share token",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -7466,7 +7486,33 @@ const docTemplate = `{
                         }
                     },
                     "400": {
-                        "description": "Only user token are available for renew.",
+                        "description": "Only link share tokens can be renewed.",
+                        "schema": {
+                            "$ref": "#/definitions/models.Message"
+                        }
+                    }
+                }
+            }
+        },
+        "/user/token/refresh": {
+            "post": {
+                "description": "Exchanges the refresh token cookie for a new short-lived JWT.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "auth"
+                ],
+                "summary": "Refresh user token",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/auth.Token"
+                        }
+                    },
+                    "401": {
+                        "description": "Invalid or expired refresh token.",
                         "schema": {
                             "$ref": "#/definitions/models.Message"
                         }
diff --git a/pkg/swagger/swagger.json b/pkg/swagger/swagger.json
index 7621bc6ca..d07f510ff 100644
--- a/pkg/swagger/swagger.json
+++ b/pkg/swagger/swagger.json
@@ -6619,6 +6619,26 @@
                 }
             }
         },
+        "/user/logout": {
+            "post": {
+                "description": "Destroys the current session and clears the refresh token cookie.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "auth"
+                ],
+                "summary": "Logout",
+                "responses": {
+                    "200": {
+                        "description": "Successfully logged out.",
+                        "schema": {
+                            "$ref": "#/definitions/models.Message"
+                        }
+                    }
+                }
+            }
+        },
         "/user/password": {
             "post": {
                 "security": [
@@ -7439,7 +7459,7 @@
         },
         "/user/token": {
             "post": {
-                "description": "Returns a new valid jwt user token with an extended length.",
+                "description": "Returns a new valid jwt link share token. Only works for link share tokens.",
                 "consumes": [
                     "application/json"
                 ],
@@ -7447,9 +7467,9 @@
                     "application/json"
                 ],
                 "tags": [
-                    "user"
+                    "auth"
                 ],
-                "summary": "Renew user token",
+                "summary": "Renew link share token",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -7458,7 +7478,33 @@
                         }
                     },
                     "400": {
-                        "description": "Only user token are available for renew.",
+                        "description": "Only link share tokens can be renewed.",
+                        "schema": {
+                            "$ref": "#/definitions/models.Message"
+                        }
+                    }
+                }
+            }
+        },
+        "/user/token/refresh": {
+            "post": {
+                "description": "Exchanges the refresh token cookie for a new short-lived JWT.",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "auth"
+                ],
+                "summary": "Refresh user token",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/auth.Token"
+                        }
+                    },
+                    "401": {
+                        "description": "Invalid or expired refresh token.",
                         "schema": {
                             "$ref": "#/definitions/models.Message"
                         }
diff --git a/pkg/swagger/swagger.yaml b/pkg/swagger/swagger.yaml
index 20ff353ec..7d733af15 100644
--- a/pkg/swagger/swagger.yaml
+++ b/pkg/swagger/swagger.yaml
@@ -6089,6 +6089,19 @@ paths:
       summary: Request a user data export.
       tags:
       - user
+  /user/logout:
+    post:
+      description: Destroys the current session and clears the refresh token cookie.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: Successfully logged out.
+          schema:
+            $ref: '#/definitions/models.Message'
+      summary: Logout
+      tags:
+      - auth
   /user/password:
     post:
       consumes:
@@ -6623,7 +6636,8 @@ paths:
     post:
       consumes:
       - application/json
-      description: Returns a new valid jwt user token with an extended length.
+      description: Returns a new valid jwt link share token. Only works for link share
+        tokens.
       produces:
       - application/json
       responses:
@@ -6632,12 +6646,29 @@ paths:
           schema:
             $ref: '#/definitions/auth.Token'
         "400":
-          description: Only user token are available for renew.
+          description: Only link share tokens can be renewed.
           schema:
             $ref: '#/definitions/models.Message'
-      summary: Renew user token
+      summary: Renew link share token
       tags:
-      - user
+      - auth
+  /user/token/refresh:
+    post:
+      description: Exchanges the refresh token cookie for a new short-lived JWT.
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/auth.Token'
+        "401":
+          description: Invalid or expired refresh token.
+          schema:
+            $ref: '#/definitions/models.Message'
+      summary: Refresh user token
+      tags:
+      - auth
   /users:
     get:
       consumes: