Exchange or refresh a token

Trade an authorization code or refresh token for a Bearer access token.

POST /oauth/token

Exchange or refresh OAuth tokens

cURL

curl --request POST \
  --url 'https://swapnice-gateway-dev.ceo-cbc.workers.dev/oauth/token?client_secret=' \
  --header 'Content-Type: application/json' \
  --data '
{
  "grant_type": "authorization_code",
  "client_id": "swa_client_01HZZZ8KQ2J9X2RW7B8Y4D2FPK",
  "client_secret": "swa_secret_example",
  "code": "swa_code_01HZZZ9N3K",
  "code_verifier": "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~",
  "redirect_uri": "https://partner.example.com/swapnice/callback"
}
'

200

{
  "access_token": "swa_at_example",
  "token_type": "Bearer",
  "expires_in": 900,
  "scope": "connections:write consent:write events:write profile:read"
}

Trade an authorization code or refresh token for a Bearer access token.

Accepts JSON or form-encoded bodies. Access tokens last about 15 minutes. Include code_verifier for authorization-code exchanges.

Authorizations

client_secret · string · query · required

Form-style client secret authentication for confidential clients where HTTP Basic is unavailable.

Body

application/jsonapplication/x-www-form-urlencoded

Option 1

Option 2

grant_type · enum<string> · required

Available options: authorization_code

code · string · required

redirect_uri · string<uri> · required

client_id · string · required

client_secret · string · required

code_verifier · string · required

Minimum string length: 43

Response

200

application/json

Token response.

access_token · string · required

token_type · enum<string> · required

Available options: Bearer

expires_in · integer · required

Example:

900

scope · string · required

refresh_token · string

Rotating refresh token when offline_access is granted.