Skip to main content
POST
Exchange OAuth code for tokens (PKCE)

Query Parameters

client_type
enum<string>
default:web

Client type determines how refresh tokens are returned:

  • web: Refresh token stored in httpOnly cookie, csrfToken returned in response
  • mobile/desktop/server: refreshToken returned directly in response body
Available options:
web,
mobile,
desktop,
server

Body

application/json
code
string
required

The insforge_code received from OAuth callback redirect

Example:

"abc123..."

code_verifier
string
required

The original code_verifier used to generate code_challenge. Must be 43-128 characters, using [A-Za-z0-9-._~]

Example:

"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"

Response

Tokens exchanged successfully

user
object
accessToken
string

JWT access token for API authentication

refreshToken
string

Refresh token for obtaining new access tokens