---
title: "Exchange authorization code or refresh token for access token"
method: POST
path: "/open-api/v1.0/platform/token"
tags: ["Platform Tokens"]
---

# Exchange authorization code or refresh token for access token

`POST /open-api/v1.0/platform/token`

*Rate limit: 100 requests / 10 seconds per shop. See [Rate limiting](/guides/rate-limiting).*

OAuth 2.0 token endpoint. Supports 'authorization_code' grant type for exchanging authorization codes for tokens, and 'refresh_token' grant type for refreshing access tokens.

## Request body

- ComFourthwallAppOpenapiEndpointTokenRequest — OAuth 2.0 token request
  - `client_id` string, required — OAuth application client ID
  - `client_secret` string — OAuth application client secret (required for confidential clients)
  - `redirect_uri` string — Redirect URI used during authorization (required for authorization_code grant)
  - `grant_type` 'authorization_code' | 'refresh_token', required — OAuth grant type
  - `code` string — Authorization code (required for authorization_code grant)
  - `refresh_token` string — Refresh token (required for refresh_token grant)
  - `code_verifier` string — PKCE code verifier (required for public clients using authorization_code grant)

## Response `200`

OK

- object

## Other responses

- `429` — Rate limited: 100 requests / 10 seconds per shop.

---

[API](https://skmtc.net/fourthwall/apis/fourthwall-apis-2.md) · [All operations](https://skmtc.net/fourthwall/apis/fourthwall-apis-2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/fourthwall/fourthwall-apis-2/revisions/ef273312f051/schema)