> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insforge.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange OAuth code for tokens (PKCE)

> Exchange the insforge_code (received from OAuth callback) for access and refresh tokens.

This endpoint is used for PKCE flow in mobile/desktop/server clients:
1. After OAuth callback, your redirect_uri receives `insforge_code` parameter
2. Call this endpoint with the code and your original code_verifier
3. Receive access token and refresh token in response

The code_verifier must match the code_challenge sent during OAuth initiation.




## OpenAPI

````yaml https://raw.githubusercontent.com/InsForge/InsForge/main/openapi/auth.yaml post /api/auth/oauth/exchange
openapi: 3.0.3
info:
  title: Insforge Authentication API
  version: 2.0.0
  description: Authentication endpoints with separated auth and profile tables
servers: []
security: []
paths:
  /api/auth/oauth/exchange:
    post:
      tags:
        - Client
      summary: Exchange OAuth code for tokens (PKCE)
      description: >
        Exchange the insforge_code (received from OAuth callback) for access and
        refresh tokens.


        This endpoint is used for PKCE flow in mobile/desktop/server clients:

        1. After OAuth callback, your redirect_uri receives `insforge_code`
        parameter

        2. Call this endpoint with the code and your original code_verifier

        3. Receive access token and refresh token in response


        The code_verifier must match the code_challenge sent during OAuth
        initiation.
      parameters:
        - name: client_type
          in: query
          schema:
            type: string
            enum:
              - web
              - mobile
              - desktop
              - server
            default: web
          description: >
            Client type determines how refresh tokens are returned:

            - web: Refresh token stored in httpOnly cookie, csrfToken returned
            in response

            - mobile/desktop/server: refreshToken returned directly in response
            body
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - code
                - code_verifier
              properties:
                code:
                  type: string
                  description: The insforge_code received from OAuth callback redirect
                  example: abc123...
                code_verifier:
                  type: string
                  description: |
                    The original code_verifier used to generate code_challenge.
                    Must be 43-128 characters, using [A-Za-z0-9-._~]
                  example: dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
      responses:
        '200':
          description: Tokens exchanged successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  user:
                    $ref: '#/components/schemas/UserResponse'
                  accessToken:
                    type: string
                    description: JWT access token for API authentication
                  refreshToken:
                    type: string
                    description: Refresh token for obtaining new access tokens
        '400':
          description: Invalid request - missing code or code_verifier
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Invalid or expired code, or code_verifier mismatch
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    UserResponse:
      type: object
      properties:
        id:
          type: string
          format: uuid
        email:
          type: string
          format: email
        profile:
          type: object
          nullable: true
          additionalProperties: true
          description: User profile data (name, avatar_url, and custom fields)
          properties:
            name:
              type: string
            avatar_url:
              type: string
              format: uri
        metadata:
          type: object
          nullable: true
          additionalProperties: true
          description: System metadata (device ID, login IP, etc.)
        emailVerified:
          type: boolean
        providers:
          type: array
          items:
            type: string
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
    ErrorResponse:
      type: object
      required:
        - error
        - message
        - statusCode
      properties:
        error:
          type: string
          description: Error code for programmatic handling
          example: VALIDATION_ERROR
        message:
          type: string
          description: Human-readable error message
          example: Email is already in use
        statusCode:
          type: integer
          description: HTTP status code
          example: 400
        nextActions:
          type: string
          description: Suggested action to resolve the error
          example: Please use a different email address

````