> ## Documentation Index > Fetch the complete documentation index at: https://swapnice.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Exchange or refresh a token > Trade an authorization code or refresh token for a Bearer access token. Trade an authorization code or refresh token for a Bearer access token. Accepts JSON or form-encoded bodies. Access tokens last about 15 minutes. Include `code_verifier` for authorization-code exchanges. ## OpenAPI ````yaml openapi.yaml POST /oauth/token openapi: 3.0.3 info: title: Swapnice Partner API version: 0.1.0 description: > Swapnice's partner API lets trusted partner applications connect customer accounts, collect explicit consent, ingest governed events and claims, and synchronously read consent-filtered profile intelligence with provenance. The API is designed for a Cloudflare Workers gateway backed by Durable Objects for short-lived sessions, per-customer ordering, consent coordination, and idempotency, plus D1 for longer-lived partner app configuration, consent archives, token metadata, customer records, and audit history. Public schemas use descriptive field names. Compact Firebase-era storage keys such as `c0`, `p0`, or `upiv` are internal implementation details and must not be exposed. contact: name: Swapnice API Support email: api@swapnice.com license: name: Proprietary url: https://swapnice.com/legal/api-terms servers: - url: https://api.swapnice.com description: Production API - url: https://api.sandbox.swapnice.com description: Sandbox API security: - OAuth2: [] tags: - name: OAuth description: OAuth 2.1 authorization, token, introspection, revocation, and discovery. - name: Apps description: Partner OAuth application configuration and webhook endpoints. - name: Connection Sessions description: Short-lived account-linking sessions coordinated by Durable Objects. - name: Consent description: Consent grants, receipts, effective consent state, and revocation. - name: Customers description: Partner-scoped customer records and metadata. - name: Ontologies description: Ontology contracts and filter-field metadata for entries and events. - name: Entries description: Ontology-backed collectible entries using readable external fields. - name: Events description: Non-blocking ordered event and claim ingestion. - name: Profiles description: Consent-aware synchronous reads for claims, intents, and profile facts. - name: Webhooks description: Partner webhook endpoint registration and delivery status. paths: /oauth/token: post: tags: - OAuth summary: Exchange or refresh OAuth tokens description: > Issues short-lived access tokens and rotating refresh tokens. Authorization-code exchanges require PKCE `code_verifier`. Clients authenticate with `client_secret_post`. operationId: createOAuthToken requestBody: required: true content: application/json: schema: oneOf: - $ref: '#/components/schemas/AuthorizationCodeTokenRequest' - $ref: '#/components/schemas/RefreshTokenRequest' example: grant_type: authorization_code client_id: swa_client_01HZZZ8KQ2J9X2RW7B8Y4D2FPK client_secret: swa_secret_example code: swa_code_01HZZZ9N3K code_verifier: >- abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~ redirect_uri: https://partner.example.com/swapnice/callback application/x-www-form-urlencoded: schema: oneOf: - $ref: '#/components/schemas/AuthorizationCodeTokenRequest' - $ref: '#/components/schemas/RefreshTokenRequest' responses: '200': description: Token response. content: application/json: schema: $ref: '#/components/schemas/OAuthTokenResponse' example: access_token: swa_at_example token_type: Bearer expires_in: 900 scope: connections:write consent:write events:write profile:read '400': $ref: '#/components/responses/OAuthErrorResponse' '401': $ref: '#/components/responses/OAuthErrorResponse' security: - ClientSecretPost: [] components: schemas: AuthorizationCodeTokenRequest: type: object required: - grant_type - code - redirect_uri - client_id - client_secret - code_verifier properties: grant_type: type: string enum: - authorization_code code: type: string redirect_uri: type: string format: uri client_id: type: string client_secret: type: string code_verifier: type: string minLength: 43 RefreshTokenRequest: type: object required: - grant_type - refresh_token - client_id - client_secret properties: grant_type: type: string enum: - refresh_token refresh_token: type: string client_id: type: string client_secret: type: string OAuthTokenResponse: type: object required: - access_token - token_type - expires_in - scope properties: access_token: type: string token_type: type: string enum: - Bearer expires_in: type: integer example: 900 refresh_token: type: string description: Rotating refresh token when `offline_access` is granted. scope: type: string OAuthError: type: object required: - error properties: error: type: string enum: - invalid_request - invalid_client - invalid_grant - unauthorized_client - unsupported_grant_type - invalid_scope error_description: type: string error_uri: type: string format: uri responses: OAuthErrorResponse: description: OAuth error response. content: application/json: schema: $ref: '#/components/schemas/OAuthError' securitySchemes: OAuth2: type: oauth2 description: >- OAuth 2.1 authorization code with PKCE. Implicit and password flows are unsupported. flows: authorizationCode: authorizationUrl: https://api.swapnice.com/oauth/authorize tokenUrl: https://api.swapnice.com/oauth/token refreshUrl: https://api.swapnice.com/oauth/token scopes: offline_access: Issue rotating refresh tokens when allowed. apps:read: Read partner app configuration. apps:write: Manage partner app configuration. connections:read: Read connection sessions. connections:write: Create or cancel connection sessions. consent:read: Read consent receipts and effective consent. consent:write: Create and revoke consent. customers:read: Read partner customers. customers:write: Create or update partner customers. ontologies:read: Read ontologies and field maps. ontologies:write: Rebuild ontology filter metadata. entries:read: Read ontology-backed entries. entries:write: Create or update ontology-backed entries. events:read: Read event status. events:write: Ingest events and claims. profile:read: Read resolved profile facts. profiles:read: Read profile resources. claims:read: Read claims. intents:read: Read intents. webhooks:read: Read webhook endpoints. webhooks:write: Manage webhook endpoints. workflows:read: Read async workflow status. tokens:introspect: Introspect tokens. tokens:revoke: Revoke tokens. ClientSecretPost: type: apiKey in: query name: client_secret description: >- Form-style client secret authentication for confidential clients where HTTP Basic is unavailable. ````