Skip to content
Infinite Audience Docs

Exchange an authorization code or refresh token for an access token

POST
/v1/oauth/token
curl --request POST \
  --url https://dev-api.infiniteaudience.ai/v1/oauth/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=authorization_code \
  --data code=example \
  --data redirect_uri=https://example.com \
  --data code_verifier=example \
  --data client_id=example \
  --data client_secret=example

Client-authenticated (RFC 6749 §3.2), not user-authenticated. Accepts application/x-www-form-urlencoded or application/json. Send your client_id/client_secret via HTTP Basic (Authorization: Basic base64(client_id:client_secret)) or as body fields. grant_type=authorization_code requires code, the exact same redirect_uri you sent to /authorize, and code_verifier (the PKCE secret whose SHA-256 hash matches the code_challenge you sent to /authorize). grant_type=refresh_token requires refresh_token and rotates it — store the refresh_token returned in the response and discard the one you presented; it is now rejected if presented again.

Request Bodyrequired

Section titled “Request Bodyrequired”
One of:
object
grant_type
required
string
Allowed value: authorization_code
code
required
string
redirect_uri
required
string format: uri
code_verifier
required

RFC 7636 PKCE verifier — must hash (S256) to the code_challenge you sent to /authorize.

string
client_id
string
client_secret
string

Responses

Section titled “Responses”

200

Section titled “200”

A fresh access token and a rotated refresh token, for either grant type.

Media typeapplication/json
object
access_token
required

Opaque bearer token. Use exactly like an API-key-derived one: Authorization: Bearer <access_token>.

string
token_type
required
string
Allowed values: Bearer
expires_in
required

Seconds until the access token expires (1800).

integer
refresh_token
required

Supersedes any previously-issued refresh token for this connection — the old one is now rejected.

string
scope
required

Space-delimited granted scopes.

string
Example
{
  "token_type": "Bearer"
}

400

Section titled “400”

RFC 6749-shaped OAuth protocol error — error is a fixed machine-readable code and error_description is a human-readable detail. Deliberately NOT this API’s usual {error, code, message} shape — this is the RFC’s own error contract, used only by /v1/oauth/authorize, /v1/oauth/token, and /v1/oauth/revoke.

Media typeapplication/json

RFC 6749 §5.2 / §4.1.2.1 error body — see the OAuthError response component.

object
error
required
string
Allowed values: invalid_request invalid_client invalid_grant invalid_scope unsupported_response_type unsupported_grant_type access_denied server_error
error_description
required
string
Example
{
  "error": "invalid_request"
}

401

Section titled “401”

RFC 6749-shaped OAuth protocol error — error is a fixed machine-readable code and error_description is a human-readable detail. Deliberately NOT this API’s usual {error, code, message} shape — this is the RFC’s own error contract, used only by /v1/oauth/authorize, /v1/oauth/token, and /v1/oauth/revoke.

Media typeapplication/json

RFC 6749 §5.2 / §4.1.2.1 error body — see the OAuthError response component.

object
error
required
string
Allowed values: invalid_request invalid_client invalid_grant invalid_scope unsupported_response_type unsupported_grant_type access_denied server_error
error_description
required
string
Example
{
  "error": "invalid_request"
}