Exchange code for tokens

POST/oauth/token

US Region: https://public-api.sessionboard.com · EU Region: https://public-api-eu.sessionboard.com

Exchange an authorization code for access and refresh tokens (authorization_code grant), or refresh an expired access token (refresh_token grant). Uses PKCE verification — no client secret required.

Request example

cURL

curl --request POST \
  --url 'https://public-api.sessionboard.com/oauth/token' \
  --header 'Content-Type: application/json' \
  --data '{
  "grant_type": "authorization_code",
  "code": "<string>",
  "redirect_uri": "<string>",
  "client_id": "<string>",
  "code_verifier": "<string>"
}'

JavaScript

const response = await fetch('https://public-api.sessionboard.com/oauth/token', {
  method: 'POST',
  headers: {
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "grant_type": "authorization_code",
    "code": "<string>",
    "redirect_uri": "<string>",
    "client_id": "<string>",
    "code_verifier": "<string>"
  }),
});

const data = await response.json();
console.log(data);

Python

import requests

response = requests.request(
    "POST",
    "https://public-api.sessionboard.com/oauth/token",
    headers={
        "Content-Type": "application/json"
    },
    json={
        "grant_type": "authorization_code",
        "code": "<string>",
        "redirect_uri": "<string>",
        "client_id": "<string>",
        "code_verifier": "<string>"
    },
)

print(response.json())

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, [
    CURLOPT_URL => "https://public-api.sessionboard.com/oauth/token",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_POSTFIELDS => '{
  "grant_type": "authorization_code",
  "code": "<string>",
  "redirect_uri": "<string>",
  "client_id": "<string>",
  "code_verifier": "<string>"
}',
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
    ],
]);

$response = curl_exec($curl);
curl_close($curl);

echo $response;

Go

package main

import (
  "fmt"
  "io"
  "net/http"
  "strings"
)

func main() {
  req, _ := http.NewRequest("POST", "https://public-api.sessionboard.com/oauth/token", strings.NewReader(`{
  "grant_type": "authorization_code",
  "code": "<string>",
  "redirect_uri": "<string>",
  "client_id": "<string>",
  "code_verifier": "<string>"
}`))
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)
  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(string(body))
}

Java

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://public-api.sessionboard.com/oauth/token"))
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString("{\n  \"grant_type\": \"authorization_code\",\n  \"code\": \"<string>\",\n  \"redirect_uri\": \"<string>\",\n  \"client_id\": \"<string>\",\n  \"code_verifier\": \"<string>\"\n}"))
    .build();

HttpResponse<String> response = HttpClient.newHttpClient()
    .send(request, HttpResponse.BodyHandlers.ofString());

System.out.println(response.body());

Try it

RegionUS Region — https://public-api.sessionboard.comEU Region — https://public-api-eu.sessionboard.com

Body application/json

{ "grant_type": "authorization_code", "code": "<string>", "redirect_uri": "<string>", "client_id": "<string>", "code_verifier": "<string>" }

POST

Send request

Request body

application/jsonrequired

• bodyobject | objectrequired
  Authorization Code Exchange

  • grant_typestringrequired

    Allowed values

    "authorization_code"

  • codestringrequired
  • redirect_uristringrequired
  • client_idstringrequired
  • code_verifierstringrequired

    PKCE code verifier

  Refresh Token

  • grant_typestringrequired

    Allowed values

    "refresh_token"

  • refresh_tokenstringrequired
  • client_idstringrequired

Example

{
  "grant_type": "authorization_code",
  "code": "<string>",
  "redirect_uri": "<string>",
  "client_id": "<string>",
  "code_verifier": "<string>"
}

Responses

200application/json

Tokens issued

• access_tokenstring
• token_typestring

  Example

  "Bearer"

• expires_ininteger

  Example

  3600

• refresh_tokenstring
• scopestring

400

Invalid grant or parameters

Response examples

200

{
  "access_token": "<string>",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "<string>",
  "scope": "<string>"
}