---
title: "Exchange Code for Token"
method: POST
path: "/token"
tags: ["Token"]
---

# Exchange Code for Token

`POST /token`

Exchanges an authorization code for an ID token, following the OAuth 2.0 standard.

## Request body

- TokenRequest
  - `grant_type` 'authorization_code', required — Must be 'authorization_code'.
  - `code` string, required — The authorization code received after a successful verification.
  - `client_id` string, required — Your application's Client ID.
  - `client_secret` string — Your application's Client Secret. Required for confidential clients.

## Response `200`

Token exchange successful.

- object
  - `id_token` string — A JWT containing the user's verified claims.

## Other responses

- `400` — Bad Request - Invalid grant_type or missing parameters.
- `401` — Unauthorized - Invalid code or client credentials.

---

[API](https://skmtc.net/hopae/apis/hconnect-api.md) · [All operations](https://skmtc.net/hopae/apis/hconnect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hopae/hconnect-api/revisions/ed6e97ac6f2f/schema)