Exchange OAuth code for tokens (PKCE)

Exchange the insforge_code (received from OAuth callback) for access and refresh tokens.

This endpoint is used for PKCE flow in mobile/desktop clients:

1. After OAuth callback, your redirect_uri receives insforge_code parameter
2. Call this endpoint with the code and your original code_verifier
3. Receive access token and refresh token in response

The code_verifier must match the code_challenge sent during OAuth initiation.

POST /api/auth/oauth/exchange

Exchange OAuth code for tokens (PKCE)

cURL

curl --request POST \
  --url https://api.example.com/api/auth/oauth/exchange \
  --header 'Content-Type: application/json' \
  --data '
{
  "code": "abc123...",
  "code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}
'

200

{
  "user": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "email": "[e-mail]",
    "profile": {
      "name": "<string>",
      "avatar_url": "<string>"
    },
    "metadata": {},
    "emailVerified": true,
    "providers": [
      "<string>"
    ],
    "createdAt": "2023-11-07T05:31:56Z",
    "updatedAt": "2023-11-07T05:31:56Z"
  },
  "accessToken": "<string>",
  "refreshToken": "<string>"
}

Body

application/json

code · string · required

The insforge_code received from OAuth callback redirect

Example:

"abc123..."

code_verifier · string · required

The original code_verifier used to generate code_challenge. Must be 43-128 characters, using [A-Za-z0-9-._~]

Example:

"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"

Response

200

application/json

Tokens exchanged successfully

user · object

Show child attributes

accessToken · string

JWT access token for API authentication

refreshToken · string

Refresh token for obtaining new access tokens