---
title: "Exchange an authorization code for a gotify client token."
method: POST
path: "/auth/oidc/external/token"
tags: ["oidc"]
---

# Exchange an authorization code for a gotify client token.

`POST /auth/oidc/external/token`

After the user authenticates with the OIDC provider and the app receives
the authorization code via redirect, the app calls this endpoint with the
code and PKCE code_verifier. The server exchanges the code with the OIDC
provider and returns a gotify client token.

## Request body

- OIDCExternalTokenRequest — Used to exchange an authorization code for a gotify client token.
  - `code` string, required — The authorization code from the OIDC provider.
  - `code_verifier` string, required — The PKCE code verifier.
  - `state` string, required — The state from the authorize response.

## Response `200`

Ok

- OIDCExternalTokenResponse — Returned after a successful token exchange.
  - `token` string, required — The gotify client token for API authentication.
  - `user` User, required — The User holds information about permission and other stuff.
    - `admin` boolean, required — If the user is an administrator.
    - `createdAt` string, date-time, required — The date the user was created.
    - `id` integer, required — The user id.
    - `name` string, required — The user name. For login.

## Other responses

- `default` — Error

---

[API](https://skmtc.net/gotify/apis/gotify-rest-api.md) · [All operations](https://skmtc.net/gotify/apis/gotify-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gotify/gotify-rest-api/revisions/7b32fcdb1345/schema)