Skip to main content
POST
Exchange authorization code for access token

Body

application/json
code
string
required

Authorization code received from the authorization endpoint

Example:

"code_abc123..."

clientId
string
required

OAuth application client ID

Example:

"app_abc123..."

clientSecret
string
required

OAuth application client secret

Example:

"cs_abc123..."

redirectUri
string
required

Redirect URI that was used in the authorization request (must match exactly)

Example:

"https://example.com/oauth/callback"

grantType
string
default:authorization_code
required

Grant type (authorization_code for code exchange)

Example:

"authorization_code"

codeVerifier
string

PKCE code verifier (required if code_challenge was provided during authorization). Random string used to generate the code_challenge.

Example:

"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"

Response

Code exchanged successfully. Returns access_token, refresh_token, token_type (Bearer), expiration time, and scopes.