---
title: "Proxy X OAuth 2.0 token exchange"
method: POST
path: "/v1/auth/x/token"
tags: ["auth"]
---

# Proxy X OAuth 2.0 token exchange

`POST /v1/auth/x/token`

Server-side proxy for X OAuth 2.0 token operations. Injects the client secret so callers (web app, extension) never need to embed it.

Supports `grant_type=authorization_code` (initial login) and `grant_type=refresh_token` (session refresh).

## Request body

- XTokenExchangeRequest — Request body for X OAuth token exchange or refresh.
  - `grant_type` string, required
  - `code` string, nullable
  - `code_verifier` string, nullable
  - `redirect_uri` string, nullable
  - `client_id` string, nullable
  - `refresh_token` string, nullable

## Response `200`

Successful Response

- object

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/grove/apis/grove-api.md) · [All operations](https://skmtc.net/grove/apis/grove-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/grove/grove-api/versions/f286b48a8105/schema)