Skip to main content
POST
Exchange auth code or refresh token for access token
client_id and client_secret must be passed in the request body. Basic Auth header is not supported.

Usage

1. Exchange Authorization Code for Token

After the user approves on the consent page, your redirect_uri receives a code parameter. Exchange it for an access token:

2. Refresh an Expired Token

Access tokens expire after 1 hour. Use the refresh token to get a new token pair:
Refresh tokens are rotated on each use — the old token is immediately invalidated. Always save the new refresh_token from the response.

Common Errors

Body

application/json
grant_type
enum<string>
required
Available options:
authorization_code,
refresh_token
client_id
string
required

Application UUID

client_secret
string
required

Application secret

code
string

Authorization code (required for authorization_code grant)

redirect_uri
string

Must match the original authorization request

refresh_token
string

Refresh token (required for refresh_token grant)

Response

Token pair issued

access_token
string
required
token_type
string
required
Example:

"Bearer"

expires_in
number
required
Example:

3600

refresh_token
string
required
scope
string
required